Vulnerabilities for DIRAC

First version without a known vulnerability: 8.0.79

Details

• GHSA-7xw9-549r-8jrc2026-07-13

  DIRAC: SQL injection and lack of access control in PilotManager service

  Fixed in: 8.0.79, 9.0.22, 9.1.10

• GHSA-vg99-gr89-qhw92026-07-13

  DIRAC: Pilot code downloaded over unverified HTTPS connection

  Fixed in: 8.0.79, 9.0.22, 9.1.10

• GHSA-m4m7-4cw8-62j62026-07-13

  DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval

  Fixed in: 8.0.79, 9.0.22, 9.1.10

• GHSA-9jpv-c7p4-997x2026-07-13

  DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input

  Fixed in: 8.0.79, 9.0.22, 9.1.10

• GHSA-v6f3-gh5h-mqwx2024-04-09

  DIRAC: Unauthorized users can read proxy contents during generation

  Fixed in: 8.0.41

• GHSA-59qj-jcjv-662j2024-02-08

  DIRAC's TokenManager does not check permissions on cached tokens

  Fixed in: 8.0.37, f9ddab755b9a69acb85e14d2db851d8ac0c9648c