DIRAC: Unauthorized users can read proxy contents during generation
Impact
During the proxy generation process (e.g., when using dirac-proxy-init) it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy.
This vulnerability only exists for a short period of time (sub-millsecond) during the generation process.
Patches
Has the problem been patched? What versions should users upgrade to?
Workarounds
Setting the X509_USER_PROXY environment variable to a path that is inside a directory that is only readable to the current user avoids the potential risk. After the file has been written it can be safely copied to the standard location (/tmp/x509up_uNNNN).
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | dirac | < 8.0.41 | 8.0.41 |
References
- https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-v6f3-gh5h-mqwx
- https://nvd.nist.gov/vuln/detail/CVE-2024-29905
- https://github.com/DIRACGrid/DIRAC/commit/1faa709341969a6321e29c843ca94039d33b2c3d
- https://github.com/DIRACGrid/DIRAC
- https://pypi.org/project/dirac
- https://github.com/advisories/GHSA-v6f3-gh5h-mqwx
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L- Weakness (CWE)
CWE-668- Platform
- Python (PyPI)
- Package
dirac- Disclosed
- 09.04.2024
- Updated
- 11.10.2026 13:18
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1295 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-v6f3-gh5h-mqwx - CC BY 4.0
Vulnerability history: dirac
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 02.2024 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 3
- High 3
Disclosures per year
- 2024: 2
- 2025: 0
- 2026: 4
-
DIRAC: Unauthorized users can read proxy contents during generation this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.