OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pmix-toolsUpgrade pmix-pmi-develUpgrade pmixUpgrade pmix-pmiUpgrade pmix-devel | May 8, 2024 | Sep 9, 2023 |
| Amazon_linux_2023 | — | Upgrade pmixUpgrade pmix-debugsourceUpgrade pmix-pmi-develUpgrade pmix-toolsUpgrade pmix-pmiUpgrade pmix-tools-debuginfoUpgrade pmix-develUpgrade pmix-debuginfoUpgrade pmix-pmi-debuginfo | Feb 17, 2025 | Sep 10, 2023 |
| Debian | — | Upgrade pmix | Nov 2, 2023 | Sep 9, 2023 |
| Oracle_linux | — | Upgrade pmix-pmiUpgrade pmix-pmi-develUpgrade pmixUpgrade pmix-toolsUpgrade pmix-devel | May 7, 2024 | Sep 10, 2023 |
| Redhat_linux | — | Upgrade pmix-develUpgrade pmixUpgrade pmix-debugsourceUpgrade pmix-toolsUpgrade pmix-pmi-develUpgrade pmix-tools-debuginfoUpgrade pmix-pmi-debuginfoUpgrade pmix-pmiUpgrade pmix-debuginfo | May 1, 2024 | Sep 9, 2023 |
| Rocky_linux | — | Upgrade pmix-develUpgrade pmix-pmi-develUpgrade pmix-tools-debuginfoUpgrade pmix-debuginfoUpgrade pmix-debugsourceUpgrade pmixUpgrade pmix-pmi-debuginfoUpgrade pmix-pmiUpgrade pmix-tools | Jun 17, 2024 | Sep 9, 2023 |
| Suse | — | Upgrade libpmix2Upgrade pmixUpgrade pmix-testUpgrade libmca_common_dstore1Upgrade pmix-develUpgrade pmix-plugin-mungeUpgrade pmix-pluginsUpgrade pmix-headersUpgrade pmix-mca-params | Sep 29, 2023 | Sep 9, 2023 |
| Ubuntu | — | Upgrade python3-pmix (Ubuntu Pro)Upgrade libpmix2 (Ubuntu Pro)Upgrade libpmi2-pmix (Ubuntu Pro)Upgrade libpmix-bin (Ubuntu Pro)Upgrade libpmi1-pmix (Ubuntu Pro) | Oct 19, 2023 | Sep 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub