Skip to content

Commit 7c26320

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-7xw9-549r-8jrc GHSA-h4pc-58cc-hc95 GHSA-m4m7-4cw8-62j6 GHSA-vg99-gr89-qhw9
1 parent a0f98eb commit 7c26320

4 files changed

Lines changed: 383 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/07/GHSA-7xw9-549r-8jrc/GHSA-7xw9-549r-8jrc.json‎

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7xw9-549r-8jrc",
4+
"modified": "2026-07-13T18:38:13Z",
5+
"published": "2026-07-13T18:38:13Z",
6+
"aliases": [],
7+
"summary": "DIRAC: SQL injection and lack of access control in PilotManager service",
8+
"details": "### Details\nA number of the functions in PilotManager pass parameters directly through to the database layer, which then does not do any escaping on the parameters. For example setPilotStatus:\nhttps://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/Service/PilotManagerHandler.py#L343-L349\n\nhttps://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/DB/PilotAgentsDB.py#L117\n\nThis won't accept multiple statements separated by a semicolon, but a carefully crafted set of parameters containing SQL escapes would likely be able to change or return other database entries.\n\nFurther to this, the PilotManager access control is only set to \"authenticated\"; this allows these functions to be called by any user. This allows any user to manage (e.g. delete, read output of) any pilot pilot job:\nhttps://github.com/DIRACGrid/DIRAC/blob/1738e7c6d2f31d26f1364255d9d2e87b4896c922/src/DIRAC/WorkloadManagementSystem/ConfigTemplate.cfg#L111-L118\n\nThis is fixed by changing the SQL statements to use proper parameter substitution and providing a suitable set of access rules for the exported pilot management functions.\n\n### Patched versions:\nhttps://pypi.org/project/DIRAC/8.0.79/\nhttps://pypi.org/project/DIRAC/9.0.22/\nhttps://pypi.org/project/DIRAC/9.1.10/",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "PyPI",
19+
"name": "DIRAC"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "6"
27+
},
28+
{
29+
"fixed": "8.0.79"
30+
}
31+
]
32+
}
33+
]
34+
},
35+
{
36+
"package": {
37+
"ecosystem": "PyPI",
38+
"name": "DIRAC"
39+
},
40+
"ranges": [
41+
{
42+
"type": "ECOSYSTEM",
43+
"events": [
44+
{
45+
"introduced": "8.1.0a1"
46+
},
47+
{
48+
"fixed": "9.0.22"
49+
}
50+
]
51+
}
52+
]
53+
},
54+
{
55+
"package": {
56+
"ecosystem": "PyPI",
57+
"name": "DIRAC"
58+
},
59+
"ranges": [
60+
{
61+
"type": "ECOSYSTEM",
62+
"events": [
63+
{
64+
"introduced": "9.1.0"
65+
},
66+
{
67+
"fixed": "9.1.10"
68+
}
69+
]
70+
}
71+
]
72+
}
73+
],
74+
"references": [
75+
{
76+
"type": "WEB",
77+
"url": "https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-7xw9-549r-8jrc"
78+
},
79+
{
80+
"type": "PACKAGE",
81+
"url": "https://github.com/DIRACGrid/DIRAC"
82+
},
83+
{
84+
"type": "WEB",
85+
"url": "https://pypi.org/project/DIRAC/8.0.79"
86+
},
87+
{
88+
"type": "WEB",
89+
"url": "https://pypi.org/project/DIRAC/9.0.22"
90+
},
91+
{
92+
"type": "WEB",
93+
"url": "https://pypi.org/project/DIRAC/9.1.10"
94+
}
95+
],
96+
"database_specific": {
97+
"cwe_ids": [
98+
"CWE-284",
99+
"CWE-89"
100+
],
101+
"severity": "HIGH",
102+
"github_reviewed": true,
103+
"github_reviewed_at": "2026-07-13T18:38:13Z",
104+
"nvd_published_at": null
105+
}
106+
}

‎advisories/github-reviewed/2026/07/GHSA-h4pc-58cc-hc95/GHSA-h4pc-58cc-hc95.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h4pc-58cc-hc95",
4+
"modified": "2026-07-13T18:37:14Z",
5+
"published": "2026-07-13T18:37:14Z",
6+
"aliases": [
7+
"CVE-2026-59955"
8+
],
9+
"summary": "Apollo ConfigService access key authentication bypass via raw config file appId parsing",
10+
"details": "### Summary\nApollo ConfigService may allow unauthorized access to raw configuration data when AccessKey / management key authentication is enabled because authentication parsed the appId incorrectly for the raw config file endpoint.\n\n### Details\nRequests under /configfiles/raw/{appId}/{clusterName}/{namespace} were parsed for authentication as appId \"raw\" instead of the actual path appId. ConfigService used the parsed appId to look up available AccessKey secrets before verifying the request signature.\n\nIf no AccessKey is configured for an application literally named \"raw\", ConfigService may treat the request as having no available secrets and allow it to continue without signature verification, even when AccessKey / management key authentication is enabled for the actual target appId in the path.\n\n### Impact\nAn unauthenticated remote attacker may read raw configuration data from affected ConfigService endpoints when AccessKey / management key authentication is enabled for the target app and the attacker requests the raw config file endpoint.\n\n### Affected endpoints\nThe primary impact is on ConfigService raw config file reads under /configfiles/raw/{appId}/{clusterName}/{namespace}.\n\n### Status\nFixed in Apollo 2.5.2. Users should upgrade to Apollo 2.5.2 or later.\n\n### Related advisory\nThe non-canonical appId matching issue is tracked separately in GHSA-4w3q-qpfq-v992 so each independently fixable vulnerability can receive its own CVE.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Maven",
21+
"name": "com.ctrip.framework.apollo:apollo"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
}
30+
]
31+
}
32+
],
33+
"database_specific": {
34+
"last_known_affected_version_range": "< 2.5.2"
35+
}
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/apolloconfig/apollo/security/advisories/GHSA-h4pc-58cc-hc95"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/apolloconfig/apollo"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/apolloconfig/apollo/releases/tag/v2.5.2"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-20",
55+
"CWE-287"
56+
],
57+
"severity": "HIGH",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-07-13T18:37:14Z",
60+
"nvd_published_at": null
61+
}
62+
}

‎advisories/github-reviewed/2026/07/GHSA-m4m7-4cw8-62j6/GHSA-m4m7-4cw8-62j6.json‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-m4m7-4cw8-62j6",
4+
"modified": "2026-07-13T18:37:31Z",
5+
"published": "2026-07-13T18:37:31Z",
6+
"aliases": [
7+
"CVE-2026-61667"
8+
],
9+
"summary": "DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval",
10+
"details": "### Summary\nThe FileCatalog DatasetManager runs a query on the database and passes the result to eval. The SQL query contains an injection vulnerability which allows an authenticated user to control the parameter returned to the eval resulting in remote code execution.\n\n### Details\n\nThe FileCatalog checkDataset function passes its datasets argument directly to the backend DB handler:\nhttps://github.com/DIRACGrid/DIRAC/blob/f7e0a3ac153315030fb3520e8ca747f013758967/src/DIRAC/DataManagementSystem/Service/FileCatalogHandler.py#L591-L593\n\nWhich in turn passes it to the __checkDataset function:\nhttps://github.com/DIRACGrid/DIRAC/blob/f7e0a3ac153315030fb3520e8ca747f013758967/src/DIRAC/DataManagementSystem/DB/FileCatalogComponents/DatasetManager/DatasetManager.py#L390\n\nThis uses an f-string to create a query without escaping, resulting in an SQL injection:\nhttps://github.com/DIRACGrid/DIRAC/blob/f7e0a3ac153315030fb3520e8ca747f013758967/src/DIRAC/DataManagementSystem/DB/FileCatalogComponents/DatasetManager/DatasetManager.py#L400-L402\n\nThe result (which is user controllable due to the SQL injection) is passed into eval almost immediately on return, leading to code execution:\nhttps://github.com/DIRACGrid/DIRAC/blob/f7e0a3ac153315030fb3520e8ca747f013758967/src/DIRAC/DataManagementSystem/DB/FileCatalogComponents/DatasetManager/DatasetManager.py#L409\n\nThere are other functions in the same file which use a similar pattern and would likely be exploitable in a similar way.\n\n### Impact\nThis allows any authenticated user to run commands on the server, which allows a full compromise of the DIRAC system (they can read the local dirac.cfg, get database passwords and export all stored proxies and tokens). If local logging is used, they can also remove evidence of the exploit from the log.\n\n### Patched versions:\nhttps://pypi.org/project/DIRAC/8.0.79/\nhttps://pypi.org/project/DIRAC/9.0.22/\nhttps://pypi.org/project/DIRAC/9.1.10/",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "DIRAC"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "6"
29+
},
30+
{
31+
"fixed": "8.0.79"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "PyPI",
40+
"name": "DIRAC"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "8.1.0a1"
48+
},
49+
{
50+
"fixed": "9.0.22"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "PyPI",
59+
"name": "DIRAC"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "9.1.0"
67+
},
68+
{
69+
"fixed": "9.1.10"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-m4m7-4cw8-62j6"
80+
},
81+
{
82+
"type": "PACKAGE",
83+
"url": "https://github.com/DIRACGrid/DIRAC"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://pypi.org/project/DIRAC/8.0.79"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://pypi.org/project/DIRAC/9.0.22"
92+
},
93+
{
94+
"type": "WEB",
95+
"url": "https://pypi.org/project/DIRAC/9.1.10"
96+
}
97+
],
98+
"database_specific": {
99+
"cwe_ids": [
100+
"CWE-89",
101+
"CWE-95"
102+
],
103+
"severity": "CRITICAL",
104+
"github_reviewed": true,
105+
"github_reviewed_at": "2026-07-13T18:37:31Z",
106+
"nvd_published_at": null
107+
}
108+
}

‎advisories/github-reviewed/2026/07/GHSA-vg99-gr89-qhw9/GHSA-vg99-gr89-qhw9.json‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-vg99-gr89-qhw9",
4+
"modified": "2026-07-13T18:37:51Z",
5+
"published": "2026-07-13T18:37:51Z",
6+
"aliases": [
7+
"CVE-2026-61668"
8+
],
9+
"summary": "DIRAC: Pilot code downloaded over unverified HTTPS connection",
10+
"details": "### Summary\nThe second stage pilot (pilot.tar) is downloaded by the initial wrapper script without any verification of the webservers' SSL certificate and the contained script is subsequently executed. The checksum is tested, but the reference checksum file is downloaded over the same unvalidated channel.\n\n### Details\nThe pilot wrapper downloads and executes the main second stage pilot script, but the SSL validation on this connection is explicitly disabled (to match old python < 2.7.9 behaviour):\nhttps://github.com/DIRACGrid/DIRAC/blob/integration/src/DIRAC/WorkloadManagementSystem/Utilities/PilotWrapper.py#L292-L296\n\nThis means that the second stage pilot code is not verified in any way and could potentially be altered by a man-in-the-middle attack to execute arbitrary code in the pilot context (i.e. with access to the pilot proxy/credentials).\n\nThe HTTPS connection should be validated against both the system certificates and $X509_CERT_DIR and fail if neither validate correctly.\n\n### Impact\nThis would require a man-in-the-middle style attack against a grid site's network (i.e. changing the DNS or routing to redirect the pilot's connection); this is likely to be difficult which probably limits the potential impact.\n\n### Patched versions:\nhttps://pypi.org/project/DIRAC/8.0.79/\nhttps://pypi.org/project/DIRAC/9.0.22/\nhttps://pypi.org/project/DIRAC/9.1.10/",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "DIRAC"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "6.20.1"
29+
},
30+
{
31+
"fixed": "8.0.79"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "PyPI",
40+
"name": "DIRAC"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "8.1.0a1"
48+
},
49+
{
50+
"fixed": "9.0.22"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "PyPI",
59+
"name": "DIRAC"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "9.1.0"
67+
},
68+
{
69+
"fixed": "9.1.10"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-vg99-gr89-qhw9"
80+
},
81+
{
82+
"type": "PACKAGE",
83+
"url": "https://github.com/DIRACGrid/DIRAC"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://pypi.org/project/DIRAC/8.0.79"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://pypi.org/project/DIRAC/9.0.22"
92+
},
93+
{
94+
"type": "WEB",
95+
"url": "https://pypi.org/project/DIRAC/9.1.10"
96+
}
97+
],
98+
"database_specific": {
99+
"cwe_ids": [
100+
"CWE-295"
101+
],
102+
"severity": "HIGH",
103+
"github_reviewed": true,
104+
"github_reviewed_at": "2026-07-13T18:37:51Z",
105+
"nvd_published_at": null
106+
}
107+
}

0 commit comments

Comments
 (0)