CVE-2024-29905: 
Python vulnerability analysis and mitigation

DIRAC, a software framework for distributed computing, was found to contain a security vulnerability prior to version 8.0.41. During the proxy generation process (e.g., when using dirac-proxy-init), unauthorized users on the same machine could gain read access to the proxy, allowing them to perform any actions possible with the original proxy. The vulnerability was discovered and disclosed on April 9, 2024, affecting all versions before 8.0.41 (GitHub Advisory).

The vulnerability exists during the proxy generation process and allows unauthorized users on the same machine to access the proxy file. While the exposure window is extremely brief (sub-millisecond), successful exploitation could lead to complete proxy access. The vulnerability has been assigned a CVSS v3.1 score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L, indicating local access requirements but high potential impact (NVD).

If exploited, the vulnerability allows unauthorized users to gain access to the proxy during its generation, enabling them to perform any actions that would be possible with the original proxy. This could potentially lead to unauthorized access to distributed computing resources and compromise of security boundaries (GitHub Advisory).

The vulnerability requires local access to the machine and exists only for a very brief period during the proxy generation process. While the attack complexity is considered low, it requires specific timing and local access to exploit (NVD).

The vulnerability has been patched in version 8.0.41. As a workaround, users can set the X509_USER_PROXY environment variable to a path inside a directory that is only readable by the current user. After the file has been written, it can be safely copied to the standard location (/tmp/x509up_uNNNN) (GitHub Advisory).