CVE-2024-29905: DIRAC Unauthorized Proxy Read Access
Summary
CVE-2024-29905: DIRAC: Unauthorized users can read proxy contents during generation. Affects dirac versions < 8.0.41. Fixed in 8.0.41. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DIRAC is a Python package available on PyPI that provides a framework for distributed computing and data management. It is commonly used in scientific research and data analysis. The package allows users to generate proxies, which are used for authentication and authorization purposes. Proxies are temporary files that grant access to certain resources. However, during the proxy generation process, there is a vulnerability that allows unauthorized users on the same machine to gain read access to the proxy. This can lead to potential security breaches and unauthorized actions with the same privileges as the original proxy.
Vulnerability Detail
The vulnerability in DIRAC arises during the proxy generation process. While generating a proxy using 'dirac-proxy-init', unauthorized users on the same machine can exploit a short-lived window of opportunity (sub-millisecond) to gain read access to the proxy. This means that they can perform any action that is possible with the original proxy, potentially compromising the security and integrity of the system. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Latest published version: 9.1.21 as of 22 Oct 2026
pip install --upgrade "dirac==9.1.21"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.0.41
This is the first release that contains the fix.
pip install --upgrade "dirac==8.0.41"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can implement a workaround by setting the 'X509_USER_PROXY' environment variable to a path that is only readable by the current user. This ensures that unauthorized users cannot access the proxy contents during the generation process. Once the proxy file has been written, it can be safely copied to the standard location '/tmp/x509up_uNNNN'.
Conclusion
The vulnerability in DIRAC allows unauthorized users to gain read access to proxy contents during the generation process. This can lead to potential security breaches and unauthorized actions with the same privileges as the original proxy. It is recommended to upgrade to the latest version of the 'dirac' package to fix this vulnerability. Alternatively, users can implement a workaround by setting the 'X509_USER_PROXY' environment variable. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dirac →
FAQ
DIRAC is a Python package used for distributed computing and data management in scientific research and data analysis.
In DIRAC, a proxy is a temporary file that grants access to certain resources. It is used for authentication and authorization purposes.
The vulnerability occurs during the proxy generation process in DIRAC. Unauthorized users on the same machine can exploit a short-lived window of opportunity to gain read access to the proxy.
Unauthorized users who gain read access to the proxy contents can perform any action that is possible with the original proxy. This can lead to security breaches and unauthorized actions with the same privileges as the original proxy.
To fix the vulnerability, users should upgrade to version 8.0.41 or later of the 'dirac' package. This includes patches that address the vulnerability and prevent unauthorized access to the proxy contents.
References
Related vulnerabilities
Recent vulnerabilities recorded for dirac.
