CVE-2017-16816
Published: 5 July 2018
The condor_schedd component in HTCondor before 8.6.8 and 8.7.x before 8.7.5 allows remote authenticated users to cause a denial of service (daemon crash) by leveraging use of GSI and VOMS extensions.
From the Ubuntu Security Team
It was discovered that HTCondor mishandled certain crafted input. An attacker could use this vulnerability to cause HTCondor to crash.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
condor Launchpad, Ubuntu, Debian |
artful |
Ignored
(end of life)
|
| bionic |
Not vulnerable
(8.6.8~dfsg.1-2)
|
|
| cosmic |
Not vulnerable
|
|
| disco |
Not vulnerable
|
|
| eoan |
Not vulnerable
|
|
| focal |
Not vulnerable
|
|
| groovy |
Does not exist
|
|
| hirsute |
Does not exist
|
|
| impish |
Does not exist
|
|
| jammy |
Does not exist
|
|
| trusty |
Released
(8.0.5~dfsg.1-1ubuntu1+esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| upstream |
Released
(8.6.8~dfsg.1-1)
|
|
| xenial |
Released
(8.4.2~dfsg.1-1ubuntu0.1~esm1)
Available with Ubuntu Pro |
|
| zesty |
Ignored
(end of life)
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 6.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |