| Version | Supported |
|---|---|
| >= 8.0 | ✅ |
| < 8.0 | ❌ |
Please report any suspected vulnerabilities in https://github.com/DIRACGrid/DIRAC/security. We will respond to you within 2 working days.
Repository navigation
Security: DIRACGrid/DIRAC
Security
SECURITY.md
-
SecurityLogging Service stops logging on a malformed requestGHSA-6hwx-p24w-6pgv published
Oct 5, 2026 by fstagniModerate -
TornadoPilotLogging (FileCachePlugin) allows arbitrary server file read as any authenticated userGHSA-vm3r-6cmw-8p5v published
Oct 5, 2026 by fstagniCritical -
Client proxies not written securely in /tmp by dirac-proxy-initGHSA-5543-m8gw-hgx5 published
Oct 5, 2026 by fstagniHigh -
Authenticated arbitrary server-side file write in SandboxStoreGHSA-pwvr-x92w-xmp8 published
Oct 5, 2026 by fstagniCritical -
Authenticated arbitrary server-side file read in ReqProxyGHSA-gfxj-386j-ffqh published
Oct 5, 2026 by fstagniCritical -
Authenticated arbitrary server-side file read in ReportGeneratorGHSA-9r9r-f79p-xwrv published
Oct 5, 2026 by fstagniCritical -
Monitoring service deleteIndex/addRecords allow any grid user to destroy or forge monitoring/accounting indicesGHSA-rgmh-64v6-h3gx published
Oct 5, 2026 by fstagniHigh -
ResourceStatus Publisher setStatus/setToken allow any grid user to force resource status via host-cert confused deputyGHSA-qgfr-cf3x-ccwc published
Oct 5, 2026 by fstagniHigh -
TokenManager updateToken allows any grid user to poison or revoke another user's OAuth tokensGHSA-q8qm-rq2q-mxxc published
Oct 5, 2026 by fstagniHigh -
JobStateUpdate service allows any grid user to mutate any job including Owner/OwnerGroup/VO and force statusGHSA-j3xg-cjx8-qjpw published
Oct 5, 2026 by fstagniHigh
Learn more about advisories related to DIRACGrid/DIRAC in the GitHub Advisory Database