DIRAC: Unauthorized users can read proxy contents during generation

CVE-2024-29905

What is CVE-2024-29905?

The DIRAC software framework for distributed computing contains a vulnerability in the proxy generation process. Prior to version 8.0.41, unauthorized users on the same machine could gain temporary read access to the proxy during the generation process triggered by the dirac-proxy-init command. This vulnerability presents risks as an unauthorized user could execute any action permissible with the original proxy. Despite the brief exposure time, it is significant for security. To mitigate the risk, users are encouraged to set the X509_USER_PROXY environment variable to a directory path readable only by themselves. After generating the file, it can be securely moved to the standard location, reducing vulnerability chances.

References