CVE-2022-26110: High severity Wisc Htcondor vulnerability
An issue was discovered in HTCondor 8.8.x before 8.8.16, 9.0.x before 9.0.10, and 9.1.x before 9.6.0. When a user authenticates to an HTCondor daemon via the CLAIMTOBE method, the user can then impersonate any entity when issuing additional commands to that daemon.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/condorto a version that resolves this vulnerability.Fixed in 23.9.6+dfsg-2.1Fixed in 25.14.1+dfsg-1 - Upgrade
Upgrade
debian/condorto a version that resolves this vulnerability.Fixed in 23.2.0+dfsg-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-26110?
CVE-2022-26110 is classified as a high-severity vulnerability due to the potential for user impersonation and unauthorized command execution.
How do I fix CVE-2022-26110?
To remediate CVE-2022-26110, users should upgrade HTCondor to version 8.8.16 or later, 9.0.10 or later, or 9.6.0 or later.
What software is affected by CVE-2022-26110?
CVE-2022-26110 affects HTCondor versions prior to 8.8.16, prior to 9.0.10, and prior to 9.6.0.
What are the implications of CVE-2022-26110?
The implications of CVE-2022-26110 include the ability for authenticated users to impersonate any entity, potentially leading to unauthorized access and control.
Is CVE-2022-26110 specific to certain operating systems?
CVE-2022-26110 is not limited to specific operating systems but affects installations of HTCondor across multiple systems including Debian.