CVE-2024-29905
DIRAC: Unauthorized users can read proxy contents during generation
DIRAC is an interware, meaning a software framework for distributed computing. Prior to version 8.0.41, during the proxy generation process (e.g., when using dirac-proxy-init), it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy. This vulnerability only exists for a short period of time (sub-millsecond) during the generation process. Version 8.0.41 contains a patch for the issue. As a workaround, setting the X509_USER_PROXY environment variable to a path that is inside a directory that is only readable to the current user avoids the potential risk. After the file has been written, it can be safely copied to the standard location (/tmp/x509up_uNNNN).
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
DIRAC: Unauthorized users can read proxy contents during generation
DIRAC is an interware, meaning a software framework for distributed computing. Prior to version 8.0.41, during the proxy generation process (e.g., when using dirac-proxy-init), it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy. This vulnerability only exists for a short period of time (sub-millsecond) during the generation process. Version 8.0.41 contains a patch for the issue. As a workaround, setting the X509_USER_PROXY environment variable to a path that is inside a directory that is only readable to the current user avoids the potential risk. After the file has been written, it can be safely copied to the standard location (/tmp/x509up_uNNNN).
- Record
CVE-2024-29905- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-668
- Updated
- 2026-11-02
EUVDEUVD-2024-1306
DIRAC is an interware, meaning a software framework for distributed computing. Prior to version 8.0.41, during the proxy generation process (e.g., when using dirac-proxy-init), it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy. This vulnerability only exists for a short period of time (sub-millsecond) during the generation process. Version 8.0.41 contains a patch for the issue. As a workaround, setting the X509_USER_PROXY environment variable to a path that is inside a directory that is only readable to the current user avoids the potential risk. After the file has been written, it can be safely copied to the standard location (/tmp/x509up_uNNNN).
- Record
EUVD-2024-1306- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v6f3-gh5h-mqwx
DIRAC: Unauthorized users can read proxy contents during generation
Impact
During the proxy generation process (e.g., when using dirac-proxy-init) it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy.
This vulnerability only exists for a short period of time (sub-millsecond) during the generation process.
Patches
Has the problem been patched? What versions should users upgrade to?
Workarounds
Setting the X509_USER_PROXY environment variable to a path that is inside a directory that is only readable to the current user avoids the potential risk. After the file has been written it can be safely copied to the standard location (/tmp/x509up_uNNNN).
References
- Record
GHSA-v6f3-gh5h-mqwx- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-668
- Updated
- 2026-11-02
NVD
DIRAC is an interware, meaning a software framework for distributed computing. Prior to version 8.0.41, during the proxy generation process (e.g., when using dirac-proxy-init), it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy. This vulnerability only exists for a short period of time (sub-millsecond) during the generation process. Version 8.0.41 contains a patch for the issue. As a workaround, setting the X509_USER_PROXY environment variable to a path that is inside a directory that is only readable to the current user avoids the potential risk. After the file has been written, it can be safely copied to the standard location (/tmp/x509up_uNNNN).
- Record
CVE-2024-29905- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-668
- Updated
- 2026-11-02
OSV
DIRAC: Unauthorized users can read proxy contents during generation
DIRAC is an interware, meaning a software framework for distributed computing. Prior to version 8.0.41, during the proxy generation process (e.g., when using dirac-proxy-init), it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy. This vulnerability only exists for a short period of time (sub-millsecond) during the generation process. Version 8.0.41 contains a patch for the issue. As a workaround, setting the X509_USER_PROXY environment variable to a path that is inside a directory that is only readable to the current user avoids the potential risk. After the file has been written, it can be safely copied to the standard location (/tmp/x509up_uNNNN).
- Record
CVE-2024-29905- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-668
- Updated
- 2026-11-02
OSVGHSA-v6f3-gh5h-mqwx
DIRAC: Unauthorized users can read proxy contents during generation
Impact
During the proxy generation process (e.g., when using dirac-proxy-init) it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy.
This vulnerability only exists for a short period of time (sub-millsecond) during the generation process.
Patches
Has the problem been patched? What versions should users upgrade to?
Workarounds
Setting the X509_USER_PROXY environment variable to a path that is inside a directory that is only readable to the current user avoids the potential risk. After the file has been written it can be safely copied to the standard location (/tmp/x509up_uNNNN).
References
- Record
GHSA-v6f3-gh5h-mqwx- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Weakness
- CWE-668
- Updated
- 2026-11-02
OSVPYSEC-2026-1295
DIRAC: Unauthorized users can read proxy contents during generation
Impact
During the proxy generation process (e.g., when using dirac-proxy-init) it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy.
This vulnerability only exists for a short period of time (sub-millsecond) during the generation process.
Patches
Has the problem been patched? What versions should users upgrade to?
Workarounds
Setting the X509_USER_PROXY environment variable to a path that is inside a directory that is only readable to the current user avoids the potential risk. After the file has been written it can be safely copied to the standard location (/tmp/x509up_uNNNN).
References
- Record
PYSEC-2026-1295- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
diracPyPI |
before 8.0.41 | 8.0.41 |
diracPyPI |
before 8.0.41, plus listed versions 7.2.07.2.0a327.2.0a337.2.0a347.2.0a35 Show 45 moreShow less7.2.0a367.2.0a387.2.0a397.2.17.2.107.2.127.2.137.2.147.2.157.2.167.2.197.2.27.2.207.2.217.2.227.2.237.2.247.2.257.2.267.2.277.2.287.2.37.2.307.2.317.2.327.2.337.2.347.2.357.2.367.2.377.2.387.2.397.2.47.2.407.2.417.2.427.2.437.2.447.2.457.2.467.2.477.2.487.2.497.2.57.2.50 |
8.0.41 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-29905 is a high vulnerability (CVSS 8.1) in Diracgrid Dirac, published April 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in dirac 8.0.41.
References
github.com/DIRACGrid/DIRAC/security/advisories/GHSA-v6f3-gh5h-mqwx
nvd.nist.gov/vuln/detail/CVE-2024-29905
pypi.org/project/dirac
Left out here: 134 versions. The JSON record has them.