GHSA-59qj-jcjv-662j
DIRAC's TokenManager does not check permissions on cached tokens
At a glance
- Published
- Updated
- CVE
- CVE-2024-24825
- Aliases
- PYSEC-2024-125
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
### Impact Any user could get a token that has been requested by another user/agent ### Patches The vulnerability is fixed in version 8.0.37. ### Workarounds None ### References
Affected packages
| Package | Versions |
|---|---|
| PyPI · dirac | introduced 8.0.0, fixed 8.0.37 |
| PyPI · dirac | introduced 0, fixed 8.0.37 |
References
- https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-59qj-jcjv-662j WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-24825 ADVISORY
- https://github.com/DIRACGrid/DIRAC/commit/9487921684e2925b4cf72d6c423718cf4950f3fe WEB
- https://github.com/DIRACGrid/DIRAC/commit/f9ddab755b9a69acb85e14d2db851d8ac0c9648c WEB
- https://github.com/DIRACGrid/DIRAC PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/dirac/PYSEC-2024-125.yaml WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |