HIGH7.5

PYSEC-2024-125

Quick fix

PYSEC-2024-125 — dirac: upgrade to the fixed version with the command below.

pip install --upgrade 'dirac>=f9ddab755b9a69acb85e14d2db851d8ac0c9648c'

Details

DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties. This issue has been addressed in release version 8.0.37. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/dirac

Introduced in: 0Fixed in: f9ddab755b9a69acb85e14d2db851d8ac0c9648c

Fixpip install --upgrade 'dirac>=f9ddab755b9a69acb85e14d2db851d8ac0c9648c'

References

https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-59qj-jcjv-662j[ADVISORY]
https://github.com/DIRACGrid/DIRAC/commit/f9ddab755b9a69acb85e14d2db851d8ac0c9648c[FIX]