CVE-2022-26110 — Htcondor vulnerability

5 documents5 sources
Severity
8.8HIGHNVD
EPSS
0.4%
top 36.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Condor Project CondorWisc HtcondorDebian Linux
Timeline
PublishedApr 6
Latest updateApr 7

Description

An issue was discovered in HTCondor 8.8.x before 8.8.16, 9.0.x before 9.0.10, and 9.1.x before 9.6.0. When a user authenticates to an HTCondor daemon via the CLAIMTOBE method, the user can then impersonate any entity when issuing additional commands to that daemon.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDwisc/htcondor8.8.0 — 8.8.16+2
▶Debiancondor_project/condor< 23.2.0+dfsg-1+1

Also affects: Debian Linux 10.0, 9.0

🔴Vulnerability Details

3
GHSA
GHSA-8vfh-w764-6gcq: An issue was discovered in HTCondor 8↗2022-04-07
▶
CVEList
CVE-2022-26110: An issue was discovered in HTCondor 8↗2022-04-06
▶
OSV
CVE-2022-26110: An issue was discovered in HTCondor 8↗2022-04-06
▶

📋Vendor Advisories

1
Debian
CVE-2022-26110: condor - An issue was discovered in HTCondor 8.8.x before 8.8.16, 9.0.x before 9.0.10, an...↗2022
▶
CVE-2022-26110 — Wisc Htcondor vulnerability | cvebase