OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pmix-toolsUpgrade pmixUpgrade pmix-pmiUpgrade pmix-develUpgrade pmix-pmi-devel | May 8, 2024 | Sep 9, 2023 |
| Amazon_linux_2023 | — | Upgrade pmix-debugsourceUpgrade pmix-pmi-develUpgrade pmixUpgrade pmix-pmi-debuginfoUpgrade pmix-debuginfoUpgrade pmix-tools-debuginfoUpgrade pmix-pmiUpgrade pmix-toolsUpgrade pmix-devel | Feb 17, 2025 | Sep 10, 2023 |
| Debian | — | Upgrade pmix | Nov 2, 2023 | Sep 9, 2023 |
| Oracle_linux | — | Upgrade pmix-pmiUpgrade pmix-pmi-develUpgrade pmix-toolsUpgrade pmix-develUpgrade pmix | May 7, 2024 | Sep 10, 2023 |
| Redhat_linux | — | Upgrade pmix-develUpgrade pmixUpgrade pmix-pmi-debuginfoUpgrade pmix-pmi-develUpgrade pmix-debugsourceUpgrade pmix-tools-debuginfoUpgrade pmix-toolsUpgrade pmix-pmiUpgrade pmix-debuginfo | May 1, 2024 | Sep 9, 2023 |
| Rocky_linux | — | Upgrade pmix-develUpgrade pmix-pmi-develUpgrade pmix-toolsUpgrade pmixUpgrade pmix-debuginfoUpgrade pmix-tools-debuginfoUpgrade pmix-debugsourceUpgrade pmix-pmiUpgrade pmix-pmi-debuginfo | Jun 17, 2024 | Sep 9, 2023 |
| Suse | — | Upgrade libpmix2Upgrade pmix-testUpgrade pmix-develUpgrade pmixUpgrade pmix-plugin-mungeUpgrade libmca_common_dstore1Upgrade pmix-mca-paramsUpgrade pmix-pluginsUpgrade pmix-headers | Sep 29, 2023 | Sep 9, 2023 |
| Ubuntu | — | Upgrade libpmix2 (Ubuntu Pro)Upgrade python3-pmix (Ubuntu Pro)Upgrade libpmi2-pmix (Ubuntu Pro)Upgrade libpmi1-pmix (Ubuntu Pro)Upgrade libpmix-bin (Ubuntu Pro) | Oct 19, 2023 | Sep 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub