PYSEC-2023-271

    Dashboard / Vulnerabilities / PYSEC-2023-271

    PYSEC-2023-271

    Published: 29 Dec 2023Last Modified: 21 Nov 2024

    Summary:

    Details: Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect (OIDC) email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change their email address, they could create accounts and use resources in clusters that they should not have access to. For example, a user could create a Microsoft or Google account and then change their email to `[email protected]`. This account can then be used to create a Hail Batch account in Hail Batch clusters whose organization domain is `example.org`. The attacker is not able to access private data or impersonate another user, but they would have the ability to run jobs if Hail Batch billing projects are enabled and create Azure Tenants if they have Azure Active Directory Administrator access.

    References: https://github.com/hail-is/hail/security/advisories/GHSA-487p-qx68-5vjw

    Affected packages

    Package

    Name: hail

    Purl: pkg:pypi/hail

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -0.2.127

    Affected versions

    0.2
    0.2.1
    0.2.10
    0.2.100
    0.2.101
    0.2.102
    0.2.103
    0.2.104
    0.2.105
    0.2.106
    0.2.107
    0.2.108
    0.2.109
    0.2.11
    0.2.110
    0.2.111
    0.2.112
    0.2.113
    0.2.114
    0.2.115
    0.2.116
    0.2.117
    0.2.118
    0.2.119
    0.2.12
    0.2.120
    0.2.121
    0.2.122
    0.2.123
    0.2.124
    0.2.125
    0.2.126
    0.2.13
    0.2.14
    0.2.15
    0.2.16
    0.2.17
    0.2.18
    0.2.19
    0.2.2
    0.2.20
    0.2.21
    0.2.22
    0.2.23
    0.2.24
    0.2.25
    0.2.26
    0.2.27
    0.2.28
    0.2.29
    0.2.3
    0.2.30
    0.2.31
    0.2.32
    0.2.33
    0.2.34
    0.2.35
    0.2.36
    0.2.37
    0.2.38
    0.2.39
    0.2.4
    0.2.40
    0.2.41
    0.2.42
    0.2.43
    0.2.44
    0.2.45
    0.2.46
    0.2.47
    0.2.48
    0.2.49
    0.2.5
    0.2.50
    0.2.51
    0.2.52
    0.2.53
    0.2.54
    0.2.55
    0.2.56
    0.2.57
    0.2.58
    0.2.59
    0.2.6
    0.2.60
    0.2.61
    0.2.62
    0.2.63
    0.2.64
    0.2.65
    0.2.66
    0.2.67
    0.2.68
    0.2.69
    0.2.7
    0.2.70
    0.2.71
    0.2.72
    0.2.73
    0.2.74
    0.2.75
    0.2.76
    0.2.77
    0.2.78
    0.2.79
    0.2.8
    0.2.80
    0.2.81
    0.2.82
    0.2.83
    0.2.84
    0.2.85
    0.2.86
    0.2.87
    0.2.88
    0.2.89
    0.2.9
    0.2.90
    0.2.91
    0.2.92
    0.2.93
    0.2.94
    0.2.95
    0.2.96
    0.2.97
    0.2.98
    0.2.99

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2023-271 | CVE-DB