PT-2022-17680 · Htcondor · Htcondor

Jaime Frey · Published 2022-04-06 · Updated 2022-09-03 · CVE-2022-26110

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HTCondor versions 8.8.x through 8.8.15 HTCondor versions 9.0.x through 9.0.9 HTCondor versions 9.1.x through 9.5.x

Description An issue was discovered in HTCondor. When a user authenticates to an HTCondor daemon via the CLAIMTOBE method, the user can then impersonate any entity when issuing additional commands to that daemon.

Recommendations For HTCondor versions 8.8.x through 8.8.15, update to version 8.8.16 or later. For HTCondor versions 9.0.x through 9.0.9, update to version 9.0.10 or later. For HTCondor versions 9.1.x through 9.5.x, update to version 9.6.0 or later.

Fix

Related Identifiers

CVE-2022-26110

DLA-2984-1

DSA-5144-1

OPENSUSE-SU-2024:11976-1

Affected Products

Htcondor

References · 17

• https://cve.org/CVERecord?id=CVE-2022-26110 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-26110 · Security Note
• https://osv.dev/vulnerability/DLA-2984-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26110 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-26110 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-26110 · Vendor Advisory
• https://debian.org/security/2022/dsa-5144 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5144-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-26110 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-26110 · Vendor Advisory
• https://github.com/htcondor/htcondor/commit/8568e8ba65c9490f30a1089b6d4f8910e4bfbd6b · Note
• https://github.com/htcondor/htcondor/commit/1cae7601d796725e7f5dd73fedf37f6fbbe379ca · Note
• https://lists.debian.org/debian-lts-announce/2022/04/msg00016.html · Note
• https://t.me/cvenotify/30567 · Telegram Post
• https://htcondor.org/security/vulnerabilities/HTCONDOR-2022-0003 · Note