Read the docs
TI-2024-19672 Aliases CVE-2024-29905GHSA-v6f3-gh5h-mqwx

DIRAC: Unauthorized users can read proxy contents during generation

Priority LOW 35CWE-668Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

DIRAC is an interware, meaning a software framework for distributed computing. Prior to version 8.0.41, during the proxy generation process (e.g., when using `dirac-proxy-init`), it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy. This vulnerability only exists for a short period of time (sub-millsecond) during the generation process. Version 8.0.41 contains a patch for the issue. As a workaround, setting the `X509_USER_PROXY` environment variable to a path that is inside a directory that is only readable to the current user avoids the potential risk. After the file has been written, it can be safely copied to the standard location (`/tmp/x509up_uNNNN`).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00319 25th percentileScored 2026-11-07
Fix Fixed DIRAC (DIRACGrid): 8.0.41DIRAC (PyPI): 8.0.41

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DIRACGridDIRACbefore 8.0.418.0.41Patch availableCNA
—DIRAC (PyPI)before 8.0.418.0.41Patch availableGHSA-v6f3-gh5h-mqwx
  • DIRAC VendorDIRACGrid Affected before 8.0.41 Fixed in 8.0.41 Patch available CNA
  • DIRAC (PyPI) Vendor— Affected before 8.0.41 Fixed in 8.0.41 Patch available GHSA-v6f3-gh5h-mqwx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:diracgrid:dirac:*:*:*:*:*:*:*:*before 8.0.41VulnerableDIRACGrid
  • cpe:2.3:a:diracgrid:dirac:*:*:*:*:*:*:*:* Versions before 8.0.41 Vulnerable ·DIRACGrid

Remediation

  • Fix · CNA DIRAC (DIRACGrid) Fixed in 8.0.41
  • Fix · GHSA-v6f3-gh5h-mqwx DIRAC (PyPI) Fixed in 8.0.41 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-29905
  2. 2026-10-03 Alias added: GHSA-v6f3-gh5h-mqwx

References

Patch 1

Advisory 2

Other 1

  • TI-2024-16342 TokenManager not checking permissions on cached tokens in DIRAC CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences