{"affected":[{"product":"rucio","source":"CNA: GitHub_M","vendor":"rucio","versions":[{"status":"affected","version":">= 1.16.1, < 35.9.0"},{"status":"affected","version":">= 36.0.0, < 38.6.0"},{"status":"affected","version":">= 39.0.0, < 41.0.0rc1"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"rucio","product":"rucio","source":"OSV GHSA-5j9r-fx4x-rpvg","vendor":"","versions":[{"status":"affected","version":"1.16.1","versionType":"PyPI"},{"status":"affected","version":"1.16.2","versionType":"PyPI"},{"status":"affected","version":"1.16.3","versionType":"PyPI"},{"status":"affected","version":"1.17.0","versionType":"PyPI"},{"status":"affected","version":"1.17.1","versionType":"PyPI"},{"status":"affected","version":"1.17.2","versionType":"PyPI"},{"status":"affected","version":"1.17.2.post1","versionType":"PyPI"},{"status":"affected","version":"1.17.5","versionType":"PyPI"},{"status":"affected","version":"1.17.6","versionType":"PyPI"},{"status":"affected","version":"1.17.6.post1","versionType":"PyPI"},{"status":"affected","version":"1.17.6.post2","versionType":"PyPI"},{"status":"affected","version":"1.17.7","versionType":"PyPI"},{"status":"affected","version":"1.17.8","versionType":"PyPI"},{"status":"affected","version":"1.17.8.post1","versionType":"PyPI"},{"status":"affected","version":"1.17.8.post2","versionType":"PyPI"},{"status":"affected","version":"1.18.0","versionType":"PyPI"},{"status":"affected","version":"1.18.1","versionType":"PyPI"},{"status":"affected","version":"1.18.3","versionType":"PyPI"},{"status":"affected","version":"1.18.4","versionType":"PyPI"},{"status":"affected","version":"1.18.5","versionType":"PyPI"},{"status":"affected","version":"1.18.5.post1","versionType":"PyPI"},{"status":"affected","version":"1.18.6","versionType":"PyPI"},{"status":"affected","version":"1.18.6.post1","versionType":"PyPI"},{"status":"affected","version":"1.18.7","versionType":"PyPI"},{"status":"affected","version":"1.18.8","versionType":"PyPI"},{"status":"affected","version":"1.18.8.post1","versionType":"PyPI"},{"status":"affected","version":"1.18.9","versionType":"PyPI"},{"status":"affected","version":"1.19.0.post2","versionType":"PyPI"},{"status":"affected","version":"1.19.1","versionType":"PyPI"},{"status":"affected","version":"1.19.3","versionType":"PyPI"},{"status":"affected","version":"1.19.4","versionType":"PyPI"},{"status":"affected","version":"1.19.4.post1","versionType":"PyPI"},{"status":"affected","version":"1.19.4.post2","versionType":"PyPI"},{"status":"affected","version":"1.19.5","versionType":"PyPI"},{"status":"affected","version":"1.19.6","versionType":"PyPI"},{"status":"affected","version":"1.19.7","versionType":"PyPI"},{"status":"affected","version":"1.19.7.post1","versionType":"PyPI"},{"status":"affected","version":"1.19.8","versionType":"PyPI"},{"status":"affected","version":"1.20.0","versionType":"PyPI"},{"status":"affected","version":"1.20.0rc1","versionType":"PyPI"},{"status":"affected","version":"1.20.1","versionType":"PyPI"},{"status":"affected","version":"1.20.1.post1","versionType":"PyPI"},{"status":"affected","version":"1.20.10","versionType":"PyPI"},{"status":"affected","version":"1.20.11","versionType":"PyPI"},{"status":"affected","version":"1.20.12","versionType":"PyPI"},{"status":"affected","version":"1.20.13","versionType":"PyPI"},{"status":"affected","version":"1.20.14","versionType":"PyPI"},{"status":"affected","version":"1.20.15","versionType":"PyPI"},{"status":"affected","version":"1.20.16","versionType":"PyPI"},{"status":"affected","version":"1.20.2","versionType":"PyPI"},{"status":"affected","version":"1.20.3","versionType":"PyPI"},{"status":"affected","version":"1.20.3rc1","versionType":"PyPI"},{"status":"affected","version":"1.20.3rc2","versionType":"PyPI"},{"status":"affected","version":"1.20.4","versionType":"PyPI"},{"status":"affected","version":"1.20.4.post1","versionType":"PyPI"},{"status":"affected","version":"1.20.4.post2","versionType":"PyPI"},{"status":"affected","version":"1.20.4rc1","versionType":"PyPI"},{"status":"affected","version":"1.20.4rc2","versionType":"PyPI"},{"status":"affected","version":"1.20.4rc3","versionType":"PyPI"},{"status":"affected","version":"1.20.5","versionType":"PyPI"},{"status":"affected","version":"1.20.6","versionType":"PyPI"},{"status":"affected","version":"1.20.7","versionType":"PyPI"},{"status":"affected","version":"1.20.8","versionType":"PyPI"},{"status":"affected","version":"1.20.9","versionType":"PyPI"},{"status":"affected","version":"1.21.0","versionType":"PyPI"},{"status":"affected","version":"1.21.0.dev1","versionType":"PyPI"},{"status":"affected","version":"1.21.0.post1","versionType":"PyPI"},{"status":"affected","version":"1.21.0.post2","versionType":"PyPI"},{"status":"affected","version":"1.21.0rc1","versionType":"PyPI"},{"status":"affected","version":"1.21.0rc2","versionType":"PyPI"},{"status":"affected","version":"1.21.0rc3","versionType":"PyPI"},{"status":"affected","version":"1.21.1","versionType":"PyPI"},{"status":"affected","version":"1.21.10","versionType":"PyPI"},{"status":"affected","version":"1.21.10.post1","versionType":"PyPI"},{"status":"affected","version":"1.21.12","versionType":"PyPI"},{"status":"affected","version":"1.21.2","versionType":"PyPI"},{"status":"affected","version":"1.21.3","versionType":"PyPI"},{"status":"affected","version":"1.21.4","versionType":"PyPI"},{"status":"affected","version":"1.21.5","versionType":"PyPI"},{"status":"affected","version":"1.21.6","versionType":"PyPI"},{"status":"affected","version":"1.21.7","versionType":"PyPI"},{"status":"affected","version":"1.21.8","versionType":"PyPI"},{"status":"affected","version":"1.22.0","versionType":"PyPI"},{"status":"affected","version":"1.22.0.dev1","versionType":"PyPI"},{"status":"affected","version":"1.22.0.dev2","versionType":"PyPI"},{"status":"affected","version":"1.22.0.dev3","versionType":"PyPI"},{"status":"affected","version":"1.22.0rc1","versionType":"PyPI"},{"status":"affected","version":"1.22.0rc2","versionType":"PyPI"},{"status":"affected","version":"1.22.1","versionType":"PyPI"},{"status":"affected","version":"1.22.2","versionType":"PyPI"},{"status":"affected","version":"1.22.3","versionType":"PyPI"},{"status":"affected","version":"1.22.3.post1","versionType":"PyPI"},{"status":"affected","version":"1.22.4","versionType":"PyPI"},{"status":"affected","version":"1.22.4.dev1","versionType":"PyPI"},{"status":"affected","version":"1.22.6","versionType":"PyPI"},{"status":"affected","version":"1.22.6.post1","versionType":"PyPI"},{"status":"affected","version":"1.22.7","versionType":"PyPI"},{"status":"affected","version":"1.22.8","versionType":"PyPI"},{"status":"affected","version":"1.22.8.post1","versionType":"PyPI"},{"status":"affected","version":"1.23.0","versionType":"PyPI"},{"status":"affected","version":"1.23.0rc1","versionType":"PyPI"},{"status":"affected","version":"1.23.0rc2","versionType":"PyPI"},{"status":"affected","version":"1.23.1","versionType":"PyPI"},{"status":"affected","version":"1.23.10","versionType":"PyPI"},{"status":"affected","version":"1.23.11","versionType":"PyPI"},{"status":"affected","version":"1.23.11.post1","versionType":"PyPI"},{"status":"affected","version":"1.23.11.post2","versionType":"PyPI"},{"status":"affected","version":"1.23.11.post3","versionType":"PyPI"},{"status":"affected","version":"1.23.11.post4","versionType":"PyPI"},{"status":"affected","version":"1.23.12","versionType":"PyPI"},{"status":"affected","version":"1.23.13","versionType":"PyPI"},{"status":"affected","version":"1.23.14","versionType":"PyPI"},{"status":"affected","version":"1.23.15","versionType":"PyPI"},{"status":"affected","version":"1.23.17","versionType":"PyPI"},{"status":"affected","version":"1.23.18","versionType":"PyPI"},{"status":"affected","version":"1.23.19","versionType":"PyPI"},{"status":"affected","version":"1.23.2","versionType":"PyPI"},{"status":"affected","version":"1.23.2.post1","versionType":"PyPI"},{"status":"affected","version":"1.23.2.post2","versionType":"PyPI"},{"status":"affected","version":"1.23.20","versionType":"PyPI"},{"status":"affected","version":"1.23.4","versionType":"PyPI"},{"status":"affected","version":"1.23.5","versionType":"PyPI"},{"status":"affected","version":"1.23.5.post1","versionType":"PyPI"},{"status":"affected","version":"1.23.6","versionType":"PyPI"},{"status":"affected","version":"1.23.6.post1","versionType":"PyPI"},{"status":"affected","version":"1.23.7","versionType":"PyPI"},{"status":"affected","version":"1.23.7.post1","versionType":"PyPI"},{"status":"affected","version":"1.23.8","versionType":"PyPI"},{"status":"affected","version":"1.23.9","versionType":"PyPI"},{"status":"affected","version":"1.23.9.post1","versionType":"PyPI"},{"status":"affected","version":"1.23.9.post2","versionType":"PyPI"},{"status":"affected","version":"1.23.9.post3","versionType":"PyPI"},{"status":"affected","version":"1.23.9.post4","versionType":"PyPI"},{"status":"affected","version":"1.24.0","versionType":"PyPI"},{"status":"affected","version":"1.24.0rc1","versionType":"PyPI"},{"status":"affected","version":"1.24.1","versionType":"PyPI"},{"status":"affected","version":"1.24.1.post1","versionType":"PyPI"},{"status":"affected","version":"1.24.1.post2","versionType":"PyPI"},{"status":"affected","version":"1.24.1.post3","versionType":"PyPI"},{"status":"affected","version":"1.24.1.post4","versionType":"PyPI"},{"status":"affected","version":"1.24.2","versionType":"PyPI"},{"status":"affected","version":"1.24.2.post1","versionType":"PyPI"},{"status":"affected","version":"1.24.3","versionType":"PyPI"},{"status":"affected","version":"1.24.3.post1","versionType":"PyPI"},{"status":"affected","version":"1.24.4","versionType":"PyPI"},{"status":"affected","version":"1.24.5","versionType":"PyPI"},{"status":"affected","version":"1.24.5.post1","versionType":"PyPI"},{"status":"affected","version":"1.25.0","versionType":"PyPI"},{"status":"affected","version":"1.25.0rc1","versionType":"PyPI"},{"status":"affected","version":"1.25.0rc2","versionType":"PyPI"},{"status":"affected","version":"1.25.1","versionType":"PyPI"},{"status":"affected","version":"1.25.1.post1","versionType":"PyPI"},{"status":"affected","version":"1.25.2","versionType":"PyPI"},{"status":"affected","version":"1.25.3","versionType":"PyPI"},{"status":"affected","version":"1.25.3.post1","versionType":"PyPI"},{"status":"affected","version":"1.25.3.post2","versionType":"PyPI"},{"status":"affected","version":"1.25.4","versionType":"PyPI"},{"status":"affected","version":"1.25.4.post1","versionType":"PyPI"},{"status":"affected","version":"1.25.5","versionType":"PyPI"},{"status":"affected","version":"1.25.6","versionType":"PyPI"},{"status":"affected","version":"1.25.7","versionType":"PyPI"},{"status":"affected","version":"1.26.0","versionType":"PyPI"},{"status":"affected","version":"1.26.0rc1","versionType":"PyPI"},{"status":"affected","version":"1.26.0rc2","versionType":"PyPI"},{"status":"affected","version":"1.26.1","versionType":"PyPI"},{"status":"affected","version":"1.26.1.post1","versionType":"PyPI"},{"status":"affected","version":"1.26.10","versionType":"PyPI"},{"status":"affected","version":"1.26.11","versionType":"PyPI"},{"status":"affected","version":"1.26.12","versionType":"PyPI"},{"status":"affected","version":"1.26.13","versionType":"PyPI"},{"status":"affected","version":"1.26.14","versionType":"PyPI"},{"status":"affected","version":"1.26.15","versionType":"PyPI"},{"status":"affected","version":"1.26.16","versionType":"PyPI"},{"status":"affected","version":"1.26.17","versionType":"PyPI"},{"status":"affected","version":"1.26.18","versionType":"PyPI"},{"status":"affected","version":"1.26.2","versionType":"PyPI"},{"status":"affected","version":"1.26.4","versionType":"PyPI"},{"status":"affected","version":"1.26.5","versionType":"PyPI"},{"status":"affected","version":"1.26.6","versionType":"PyPI"},{"status":"affected","version":"1.26.7","versionType":"PyPI"},{"status":"affected","version":"1.26.7.post1","versionType":"PyPI"},{"status":"affected","version":"1.26.8","versionType":"PyPI"},{"status":"affected","version":"1.26.8.post1","versionType":"PyPI"},{"status":"affected","version":"1.26.9","versionType":"PyPI"},{"status":"affected","version":"1.27.0","versionType":"PyPI"},{"status":"affected","version":"1.27.0.post1","versionType":"PyPI"},{"status":"affected","version":"1.27.0rc1","versionType":"PyPI"},{"status":"affected","version":"1.27.0rc2","versionType":"PyPI"},{"status":"affected","version":"1.27.1","versionType":"PyPI"},{"status":"affected","version":"1.27.10","versionType":"PyPI"},{"status":"affected","version":"1.27.11","versionType":"PyPI"},{"status":"affected","version":"1.27.12","versionType":"PyPI"},{"status":"affected","version":"1.27.2","versionType":"PyPI"},{"status":"affected","version":"1.27.3","versionType":"PyPI"},{"status":"affected","version":"1.27.4","versionType":"PyPI"},{"status":"affected","version":"1.27.4.post1","versionType":"PyPI"},{"status":"affected","version":"1.27.5","versionType":"PyPI"},{"status":"affected","version":"1.27.7","versionType":"PyPI"},{"status":"affected","version":"1.27.9","versionType":"PyPI"},{"status":"affected","version":"1.28.0","versionType":"PyPI"},{"status":"affected","version":"1.28.0rc1","versionType":"PyPI"},{"status":"affected","version":"1.28.0rc2","versionType":"PyPI"},{"status":"affected","version":"1.28.1","versionType":"PyPI"},{"status":"affected","version":"1.28.2","versionType":"PyPI"},{"status":"affected","version":"1.28.3","versionType":"PyPI"},{"status":"affected","version":"1.28.4","versionType":"PyPI"},{"status":"affected","version":"1.28.5","versionType":"PyPI"},{"status":"affected","version":"1.28.6","versionType":"PyPI"},{"status":"affected","version":"1.28.7","versionType":"PyPI"},{"status":"affected","version":"1.29.0","versionType":"PyPI"},{"status":"affected","version":"1.29.0rc1","versionType":"PyPI"},{"status":"affected","version":"1.29.0rc2","versionType":"PyPI"},{"status":"affected","version":"1.29.1","versionType":"PyPI"},{"status":"affected","version":"1.29.10","versionType":"PyPI"},{"status":"affected","version":"1.29.11","versionType":"PyPI"},{"status":"affected","version":"1.29.12","versionType":"PyPI"},{"status":"affected","version":"1.29.13","versionType":"PyPI"},{"status":"affected","version":"1.29.14","versionType":"PyPI"},{"status":"affected","version":"1.29.15","versionType":"PyPI"},{"status":"affected","version":"1.29.16","versionType":"PyPI"},{"status":"affected","version":"1.29.17","versionType":"PyPI"},{"status":"affected","version":"1.29.18","versionType":"PyPI"},{"status":"affected","version":"1.29.19","versionType":"PyPI"},{"status":"affected","version":"1.29.2","versionType":"PyPI"},{"status":"affected","version":"1.29.2.post1","versionType":"PyPI"},{"status":"affected","version":"1.29.2.post2","versionType":"PyPI"},{"status":"affected","version":"1.29.3","versionType":"PyPI"},{"status":"affected","version":"1.29.3.post1","versionType":"PyPI"},{"status":"affected","version":"1.29.4","versionType":"PyPI"},{"status":"affected","version":"1.29.5","versionType":"PyPI"},{"status":"affected","version":"1.29.6","versionType":"PyPI"},{"status":"affected","version":"1.29.7","versionType":"PyPI"},{"status":"affected","version":"1.29.7.post1","versionType":"PyPI"},{"status":"affected","version":"1.29.8","versionType":"PyPI"},{"status":"affected","version":"1.29.9","versionType":"PyPI"},{"status":"affected","version":"1.30.0","versionType":"PyPI"},{"status":"affected","version":"1.30.0rc1","versionType":"PyPI"},{"status":"affected","version":"1.30.0rc2","versionType":"PyPI"},{"status":"affected","version":"1.30.0rc3","versionType":"PyPI"},{"status":"affected","version":"1.30.1","versionType":"PyPI"},{"status":"affected","version":"1.30.2","versionType":"PyPI"},{"status":"affected","version":"1.30.3","versionType":"PyPI"},{"status":"affected","version":"1.30.4","versionType":"PyPI"},{"status":"affected","version":"1.30.5","versionType":"PyPI"},{"status":"affected","version":"1.30.6","versionType":"PyPI"},{"status":"affected","version":"1.30.7","versionType":"PyPI"},{"status":"affected","version":"1.30.8","versionType":"PyPI"},{"status":"affected","version":"1.31.0","versionType":"PyPI"},{"status":"affected","version":"1.31.0rc1","versionType":"PyPI"},{"status":"affected","version":"1.31.0rc2","versionType":"PyPI"},{"status":"affected","version":"1.31.0rc3","versionType":"PyPI"},{"status":"affected","version":"1.31.1","versionType":"PyPI"},{"status":"affected","version":"1.31.2","versionType":"PyPI"},{"status":"affected","version":"1.31.3","versionType":"PyPI"},{"status":"affected","version":"1.31.4","versionType":"PyPI"},{"status":"affected","version":"1.31.5","versionType":"PyPI"},{"status":"affected","version":"1.31.6","versionType":"PyPI"},{"status":"affected","version":"1.31.7","versionType":"PyPI"},{"status":"affected","version":"32.0.0","versionType":"PyPI"},{"status":"affected","version":"32.0.0rc1","versionType":"PyPI"},{"status":"affected","version":"32.0.0rc2","versionType":"PyPI"},{"status":"affected","version":"32.1.0","versionType":"PyPI"},{"status":"affected","version":"32.2.0","versionType":"PyPI"},{"status":"affected","version":"32.3.0","versionType":"PyPI"},{"status":"affected","version":"32.3.1","versionType":"PyPI"},{"status":"affected","version":"32.4.0","versionType":"PyPI"},{"status":"affected","version":"32.5.0","versionType":"PyPI"},{"status":"affected","version":"32.5.0.post1","versionType":"PyPI"},{"status":"affected","version":"32.5.1","versionType":"PyPI"},{"status":"affected","version":"32.6.0","versionType":"PyPI"},{"status":"affected","version":"32.6.0.post1","versionType":"PyPI"},{"status":"affected","version":"32.7.0","versionType":"PyPI"},{"status":"affected","version":"32.8.0","versionType":"PyPI"},{"status":"affected","version":"32.8.1","versionType":"PyPI"},{"status":"affected","version":"32.8.2","versionType":"PyPI"},{"status":"affected","version":"32.8.3","versionType":"PyPI"},{"status":"affected","version":"32.8.4","versionType":"PyPI"},{"status":"affected","version":"32.8.5","versionType":"PyPI"},{"status":"affected","version":"32.8.6","versionType":"PyPI"},{"status":"affected","version":"33.0.0","versionType":"PyPI"},{"status":"affected","version":"33.0.0rc1","versionType":"PyPI"},{"status":"affected","version":"33.0.0rc2","versionType":"PyPI"},{"status":"affected","version":"33.0.0rc3","versionType":"PyPI"},{"status":"affected","version":"33.1.0","versionType":"PyPI"},{"status":"affected","version":"33.2.0","versionType":"PyPI"},{"status":"affected","version":"33.2.1","versionType":"PyPI"},{"status":"affected","version":"33.3.0","versionType":"PyPI"},{"status":"affected","version":"33.4.0","versionType":"PyPI"},{"status":"affected","version":"33.4.0.post1","versionType":"PyPI"},{"status":"affected","version":"33.5.0","versionType":"PyPI"},{"status":"affected","version":"33.6.0","versionType":"PyPI"},{"status":"affected","version":"33.6.1","versionType":"PyPI"},{"status":"affected","version":"34.0.0","versionType":"PyPI"},{"status":"affected","version":"34.0.0rc1","versionType":"PyPI"},{"status":"affected","version":"34.0.0rc2","versionType":"PyPI"},{"status":"affected","version":"34.1.0","versionType":"PyPI"},{"status":"affected","version":"34.2.0","versionType":"PyPI"},{"status":"affected","version":"34.3.0","versionType":"PyPI"},{"status":"affected","version":"34.4.0","versionType":"PyPI"},{"status":"affected","version":"34.4.1","versionType":"PyPI"},{"status":"affected","version":"34.4.2","versionType":"PyPI"},{"status":"affected","version":"34.4.3","versionType":"PyPI"},{"status":"affected","version":"34.5.0","versionType":"PyPI"},{"status":"affected","version":"34.6.0","versionType":"PyPI"},{"status":"affected","version":"35.0.0","versionType":"PyPI"},{"status":"affected","version":"35.0.0rc1","versionType":"PyPI"},{"status":"affected","version":"35.0.0rc2","versionType":"PyPI"},{"status":"affected","version":"35.0.1","versionType":"PyPI"},{"status":"affected","version":"35.1.0","versionType":"PyPI"},{"status":"affected","version":"35.1.1","versionType":"PyPI"},{"status":"affected","version":"35.2.0","versionType":"PyPI"},{"status":"affected","version":"35.2.1","versionType":"PyPI"},{"status":"affected","version":"35.3.0","versionType":"PyPI"},{"status":"affected","version":"35.4.0","versionType":"PyPI"},{"status":"affected","version":"35.4.1","versionType":"PyPI"},{"status":"affected","version":"35.5.0","versionType":"PyPI"},{"status":"affected","version":"35.6.0","versionType":"PyPI"},{"status":"affected","version":"35.6.1","versionType":"PyPI"},{"status":"affected","version":"35.7.0","versionType":"PyPI"},{"status":"affected","version":"35.8.0","versionType":"PyPI"},{"status":"affected","version":"35.8.1","versionType":"PyPI"},{"status":"affected","version":"35.8.2","versionType":"PyPI"},{"status":"affected","version":"35.8.3","versionType":"PyPI"},{"status":"affected","version":"35.8.4","versionType":"PyPI"},{"status":"affected","version":"35.8.5","versionType":"PyPI"},{"events":[{"introduced":"1.16.1"},{"fixed":"35.9.0"}],"status":"unknown","version":"1.16.1","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"rucio","product":"rucio","source":"OSV GHSA-5j9r-fx4x-rpvg","vendor":"","versions":[{"status":"affected","version":"36.0.0","versionType":"PyPI"},{"status":"affected","version":"36.0.0.post1","versionType":"PyPI"},{"status":"affected","version":"36.0.0.post2","versionType":"PyPI"},{"status":"affected","version":"36.0.0rc1","versionType":"PyPI"},{"status":"affected","version":"36.0.0rc2","versionType":"PyPI"},{"status":"affected","version":"36.0.0rc3","versionType":"PyPI"},{"status":"affected","version":"36.0.0rc4","versionType":"PyPI"},{"status":"affected","version":"36.0.0rc5","versionType":"PyPI"},{"status":"affected","version":"36.1.0","versionType":"PyPI"},{"status":"affected","version":"36.2.0","versionType":"PyPI"},{"status":"affected","version":"36.3.0","versionType":"PyPI"},{"status":"affected","version":"36.4.0","versionType":"PyPI"},{"status":"affected","version":"36.5.0","versionType":"PyPI"},{"status":"affected","version":"37.0.0","versionType":"PyPI"},{"status":"affected","version":"37.0.0rc1","versionType":"PyPI"},{"status":"affected","version":"37.0.0rc2","versionType":"PyPI"},{"status":"affected","version":"37.0.0rc3","versionType":"PyPI"},{"status":"affected","version":"37.0.0rc4","versionType":"PyPI"},{"status":"affected","version":"37.1.0","versionType":"PyPI"},{"status":"affected","version":"37.1.0.post1","versionType":"PyPI"},{"status":"affected","version":"37.2.0","versionType":"PyPI"},{"status":"affected","version":"37.3.0","versionType":"PyPI"},{"status":"affected","version":"37.4.0","versionType":"PyPI"},{"status":"affected","version":"37.5.0","versionType":"PyPI"},{"status":"affected","version":"37.6.0","versionType":"PyPI"},{"status":"affected","version":"37.7.0","versionType":"PyPI"},{"status":"affected","version":"37.7.1","versionType":"PyPI"},{"status":"affected","version":"38.0.0","versionType":"PyPI"},{"status":"affected","version":"38.0.0rc1","versionType":"PyPI"},{"status":"affected","version":"38.0.0rc2","versionType":"PyPI"},{"status":"affected","version":"38.0.0rc3","versionType":"PyPI"},{"status":"affected","version":"38.1.0","versionType":"PyPI"},{"status":"affected","version":"38.2.0","versionType":"PyPI"},{"status":"affected","version":"38.3.0","versionType":"PyPI"},{"status":"affected","version":"38.4.0","versionType":"PyPI"},{"status":"affected","version":"38.5.0","versionType":"PyPI"},{"status":"affected","version":"38.5.1","versionType":"PyPI"},{"status":"affected","version":"38.5.2","versionType":"PyPI"},{"status":"affected","version":"38.5.3","versionType":"PyPI"},{"status":"affected","version":"38.5.4","versionType":"PyPI"},{"status":"affected","version":"38.5.5","versionType":"PyPI"},{"events":[{"introduced":"36.0.0rc1"},{"fixed":"38.6.0"}],"status":"unknown","version":"36.0.0rc1","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"rucio","product":"rucio","source":"OSV GHSA-5j9r-fx4x-rpvg","vendor":"","versions":[{"status":"affected","version":"39.0.0","versionType":"PyPI"},{"status":"affected","version":"39.0.0rc1","versionType":"PyPI"},{"status":"affected","version":"39.0.0rc2","versionType":"PyPI"},{"status":"affected","version":"39.1.0","versionType":"PyPI"},{"status":"affected","version":"39.2.0","versionType":"PyPI"},{"status":"affected","version":"39.3.0","versionType":"PyPI"},{"status":"affected","version":"39.3.1","versionType":"PyPI"},{"status":"affected","version":"39.4.0","versionType":"PyPI"},{"status":"affected","version":"39.4.1","versionType":"PyPI"},{"status":"affected","version":"39.4.2","versionType":"PyPI"},{"status":"affected","version":"40.0.0","versionType":"PyPI"},{"status":"affected","version":"40.0.0rc1","versionType":"PyPI"},{"status":"affected","version":"40.1.0","versionType":"PyPI"},{"status":"affected","version":"40.1.1","versionType":"PyPI"},{"status":"affected","version":"40.1.2","versionType":"PyPI"},{"status":"affected","version":"40.2.0","versionType":"PyPI"},{"status":"affected","version":"40.3.0","versionType":"PyPI"},{"status":"affected","version":"40.4.0","versionType":"PyPI"},{"status":"affected","version":"40.4.1","versionType":"PyPI"},{"status":"affected","version":"40.4.2","versionType":"PyPI"},{"events":[{"introduced":"39.0.0rc1"},{"fixed":"41.0.0rc1"}],"status":"unknown","version":"39.0.0rc1","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-58273","cwes":["CWE-639"],"description":"Rucio is a scientific data management framework. From 1.16.1 until 35.9.0, 38.6.0, and 41.0.0rc1, the /credentials/signurl endpoint reads X-Rucio-Account instead of the account stored in request.environ['issuer'] by token authentication. Any authenticated low-privilege user can supply root as the header value and pass the root-only get_signed_url permission check. The server then returns a presigned read, write, or delete URL for an attacker-selected object using stored S3, GCS, or Swift credentials, and X-Rucio-VO can select another tenant in multi-VO deployments. This permits data disclosure, modification, deletion, and cross-tenant access on cloud-backed RSEs. This issue is fixed in versions 35.9.0, 38.6.0, and 41.0.0rc1.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.1,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1793915780677,"publishedAt":1793915780677,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/rucio/rucio/security/advisories/GHSA-5j9r-fx4x-rpvg"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/rucio/rucio/commit/64c0e6a6a93ae88427ff3b7d77532ce08c8a69ec"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/rucio/rucio/commit/8bdc38994a8766658d0314d36afc104c9242c96f"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/rucio/rucio/commit/8d9ba31514e6f5dca32b8c1db4738582cb37ec3a"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/rucio/rucio/releases/tag/35.9.0"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/rucio/rucio/releases/tag/38.6.0"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/rucio/rucio/releases/tag/41.0.0rc1"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-5j9r-fx4x-rpvg"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-5j9r-fx4x-rpvg"}],"remediation":[{"kind":"fix","source":"OSV GHSA-5j9r-fx4x-rpvg","text":"rucio (PyPI): OSV reports a fixed version 35.9.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-5j9r-fx4x-rpvg"},{"kind":"fix","source":"OSV GHSA-5j9r-fx4x-rpvg","text":"rucio (PyPI): OSV reports a fixed version 38.6.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-5j9r-fx4x-rpvg"},{"kind":"fix","source":"OSV GHSA-5j9r-fx4x-rpvg","text":"rucio (PyPI): OSV reports a fixed version 41.0.0rc1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-5j9r-fx4x-rpvg"}],"revision":"3bf1345554571f987e97beb08890b363c1182c89af43ea93ff61dd55283dd693","sources":[{"modifiedAt":1793915780677,"name":"CNA: GitHub_M","retrievedAt":1793917155622,"url":"https://www.cve.org/CVERecord?id=CVE-2026-58273"},{"modifiedAt":1793217603935,"name":"OSV / GitHub Security Advisories","retrievedAt":1793917156327,"url":"https://osv.dev/vulnerability/GHSA-5j9r-fx4x-rpvg"}],"ssvc":null,"status":"published","title":"Rucio: Authorisation Bypass on REST API endpoint for signing URLs","updatedAt":1793917156327}