OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pmix-toolsUpgrade pmixUpgrade pmix-pmi-develUpgrade pmix-develUpgrade pmix-pmi | May 8, 2024 | Sep 9, 2023 |
| Amazon_linux_2023 | — | Upgrade pmix-debugsourceUpgrade pmixUpgrade pmix-pmi-develUpgrade pmix-debuginfoUpgrade pmix-pmi-debuginfoUpgrade pmix-develUpgrade pmix-pmiUpgrade pmix-toolsUpgrade pmix-tools-debuginfo | Feb 17, 2025 | Sep 10, 2023 |
| Debian | — | Upgrade pmix | Nov 2, 2023 | Sep 9, 2023 |
| Oracle_linux | — | Upgrade pmix-develUpgrade pmixUpgrade pmix-toolsUpgrade pmix-pmi-develUpgrade pmix-pmi | May 7, 2024 | Sep 10, 2023 |
| Redhat_linux | — | Upgrade pmixUpgrade pmix-develUpgrade pmix-toolsUpgrade pmix-pmiUpgrade pmix-pmi-debuginfoUpgrade pmix-debuginfoUpgrade pmix-pmi-develUpgrade pmix-tools-debuginfoUpgrade pmix-debugsource | May 1, 2024 | Sep 9, 2023 |
| Rocky_linux | — | Upgrade pmix-pmi-develUpgrade pmix-develUpgrade pmix-toolsUpgrade pmix-pmi-debuginfoUpgrade pmixUpgrade pmix-debuginfoUpgrade pmix-debugsourceUpgrade pmix-pmiUpgrade pmix-tools-debuginfo | Jun 17, 2024 | Sep 9, 2023 |
| Suse | — | Upgrade pmix-develUpgrade libpmix2Upgrade pmix-plugin-mungeUpgrade pmix-testUpgrade pmixUpgrade libmca_common_dstore1Upgrade pmix-mca-paramsUpgrade pmix-headersUpgrade pmix-plugins | Sep 29, 2023 | Sep 9, 2023 |
| Ubuntu | — | Upgrade libpmix-bin (Ubuntu Pro)Upgrade libpmi1-pmix (Ubuntu Pro)Upgrade python3-pmix (Ubuntu Pro)Upgrade libpmix2 (Ubuntu Pro)Upgrade libpmi2-pmix (Ubuntu Pro) | Oct 19, 2023 | Sep 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub