GHSA-v988-828w-xvf2

Source

https://github.com/advisories/GHSA-v988-828w-xvf2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-v988-828w-xvf2/GHSA-v988-828w-xvf2.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-v988-828w-xvf2

Published

2021-10-22T16:21:07Z

Modified

2025-02-13T05:15:53.572505Z

Summary

Authentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webui

Details

Impact

rucio-webui installations of the 1.26 release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the webui within a close timeframe, thus allowing users to access the webui with the leaked authentication token. Privileges are therefore also escalated.

Rucio server / daemons are not affected by this issue, it is isolated to the webui.

Patches

This issue is fixed in the 1.26.7 release of the rucio-webui.

Workarounds

Installation of the 1.25.7 webui release. The 1.25 and previous webui release lines are not affected by this issue.

References

https://github.com/rucio/rucio/issues/4928

Database specific

{
    "cwe_ids": [
        "CWE-288",
        "CWE-305"
    ],
    "github_reviewed_at": "2021-10-21T21:36:22Z",
    "github_reviewed": true,
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

PyPI / rucio-webui

Package

Name: rucio-webui; View open source insights on deps.dev
Purl: pkg:pypi/rucio-webui

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.26.0

Fixed

1.26.7

Affected versions

1.*

1.26.0

1.26.1

1.26.1.post1

1.26.2

1.26.4

1.26.5

1.26.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-v988-828w-xvf2/GHSA-v988-828w-xvf2.json"