p PatchFirst

GHSA-v988-828w-xvf2

GHSA-v988-828w-xvf2 · Authentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webui

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

### Impact `rucio-webui` installations of the `1.26` release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the `webui` within a close timeframe, thus allowing users to access the `webui` with the leaked authentication token. Privileges are therefore also escalated. Rucio server / daemons are not affected by this issue, it is isolated to the webui. ### Patches This issue is fixed in the `1.26.7` release of the `rucio-webui`. ### Workarounds Installation of the `1.25.7` `webui` release. The `1.25` and previous webui release lines are not affected by this issue. ### References https://github.com/rucio/rucio/issues/4928

Korrektur verfügbar

Veröffentlicht
Aktualisiert

Technologie-Stack: python

Betroffene Produkte und Versionen

  • rucio-webui PyPI

    Softwareversionen
    • 1.26.0
    • 1.26.1
    • 1.26.1.post1
    • 1.26.2
    • 1.26.4
    • 1.26.5
    • 1.26.6
    Betroffene Versionsbereiche
    • ECOSYSTEM: ≥ 1.26.0, < 1.26.7

    Auf 1.26.7 aktualisieren

Originalquellen

Prüfen Sie Ihren Server →