PT-2020-9988 · Htcondor · Htcondor

Tj Knoeller · Published 2020-04-27 · Updated 2022-10-06 · CVE-2019-18823

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: HTCondor versions 8.8.6 and earlier HTCondor versions 8.9.4 and earlier

Description: The issue is related to Incorrect Access Control, allowing the use of a different authentication method to submit a job than the administrator has specified. If the administrator has configured the READ or WRITE methods to include CLAIMTOBE, it is possible to impersonate another user to the condor schedd, potentially allowing actions such as submitting or removing jobs.

Recommendations: For HTCondor versions 8.8.6 and earlier, update to a version that includes the fix for this issue. For HTCondor versions 8.9.4 and earlier, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of CLAIMTOBE in the READ and WRITE methods to prevent impersonation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2019-18823

DLA-2724-1

DSA-5144-1

Affected Products

Htcondor

References · 28

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VMPZ7XPOPA4JGAQAUJ4K7JV653DSCIDK · Vendor Advisory
• https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2020-0001.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-18823 · Security Note
• https://ubuntu.com/security/CVE-2019-18823 · Vendor Advisory
• https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2020-0002.html · Vendor Advisory
• https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2020-0004.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EOTJJOSMYKXIYXWSG3H4KN332EDSEB6 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-18823 · Vendor Advisory
• https://debian.org/security/2022/dsa-5144 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-18823 · Vendor Advisory
• https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2020-0003.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-18823 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-18823 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5144-1 · Vendor Advisory
• https://research.cs.wisc.edu/htcondor/new.html · Vendor Advisory