CVE-2024-29905 json
DIRAC: Unauthorized users can read proxy contents during generation
published 2024-04-09 2 y ago modified 2026-07-07 4 mo ago also EUVD-2024-1306 , GHSA-v6f3-gh5h-mqwx , PYSEC-2026-1295
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 25%
- public exploits
- 0
- none known
Summary
DIRAC is an interware, meaning a software framework for distributed computing. Prior to version 8.0.41, during the proxy generation process (e.g., when using `dirac-proxy-init`), it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy. This vulnerability only exists for a short period of time (sub-millsecond) during the generation process. Version 8.0.41 contains a patch for the issue. As a workaround, setting the `X509_USER_PROXY` environment variable to a path that is inside a directory that is only readable to the current user avoids the potential risk. After the file has been written, it can be safely copied to the standard location (`/tmp/x509up_uNNNN`).
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 8.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | dirac | <8.0.41 |
8.0.41 |
Affected products
- DIRACGrid DIRAC
Classification
- Weakness
-
- CWE-668 Exposure of Resource to Wrong Sphere
References
-
github.com
/DIRACGrid/DIRAC/commit/1faa709341969a6321e29c843ca94039d33b2c3d
web, patch
-
github.com
/DIRACGrid/DIRAC/security/advisories/GHSA-v6f3-gh5h-mqwx
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-29905
advisory
-
github.com
/DIRACGrid/DIRAC
package
-
pypi.org
/project/dirac
package
-
github.com
/advisories/GHSA-v6f3-gh5h-mqwx
advisory
Sources
- CVE List CVE-2024-29905
- GitHub Advisory GHSA-v6f3-gh5h-mqwx
- NVD CVE-2024-29905
- OSV PYSEC-2026-1295
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.