Race Condition Affecting ophyd-async package, versions [,0.5.1)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Race Condition vulnerabilities in an interactive lesson.

Start learning

Snyk IDSNYK-PYTHON-OPHYDASYNC-8145546
published2 Oct 2024
disclosed1 Oct 2024
creditDominic Oram

Report a new vulnerability Found a mistake?

Introduced: 1 Oct 2024

CWE-362 (opens in a new tab)

How to fix?

Upgrade ophyd-async to version 0.5.1 or higher.

Overview

ophyd-async is an Asynchronous Bluesky hardware abstraction code, compatible with control systems like EPICS and Tango

Affected versions of this package are vulnerable to Race Condition when setting one signal and monitoring another. This issue could lead to missed signal changes or incorrect system behaviour in asynchronous environments.

References

GitHub Commit

CVSS Scores

version 4.0

version 3.1

Attack Vector (AV)
Network
Attack Complexity (AC)
High
Attack Requirements (AT)
None
Privileges Required (PR)
None
User Interaction (UI)
None

Confidentiality (VC)
Low
Integrity (VI)
None
Availability (VA)
High

Confidentiality (SC)
None
Integrity (SI)
None
Availability (SA)
None