OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pmix-toolsUpgrade pmix-develUpgrade pmix-pmiUpgrade pmixUpgrade pmix-pmi-devel | May 8, 2024 | Sep 9, 2023 |
| Amazon_linux_2023 | — | Upgrade pmix-pmi-develUpgrade pmix-debugsourceUpgrade pmixUpgrade pmix-pmi-debuginfoUpgrade pmix-debuginfoUpgrade pmix-toolsUpgrade pmix-pmiUpgrade pmix-develUpgrade pmix-tools-debuginfo | Feb 17, 2025 | Sep 10, 2023 |
| Debian | — | Upgrade pmix | Nov 2, 2023 | Sep 9, 2023 |
| Oracle_linux | — | Upgrade pmix-toolsUpgrade pmixUpgrade pmix-develUpgrade pmix-pmiUpgrade pmix-pmi-devel | May 7, 2024 | Sep 10, 2023 |
| Redhat_linux | — | Upgrade pmix-develUpgrade pmixUpgrade pmix-pmi-develUpgrade pmix-debuginfoUpgrade pmix-toolsUpgrade pmix-pmiUpgrade pmix-pmi-debuginfoUpgrade pmix-tools-debuginfoUpgrade pmix-debugsource | May 1, 2024 | Sep 9, 2023 |
| Rocky_linux | — | Upgrade pmix-debuginfoUpgrade pmix-pmi-debuginfoUpgrade pmix-tools-debuginfoUpgrade pmix-toolsUpgrade pmix-debugsourceUpgrade pmixUpgrade pmix-pmiUpgrade pmix-develUpgrade pmix-pmi-devel | Jun 17, 2024 | Sep 9, 2023 |
| Suse | — | Upgrade libpmix2Upgrade pmix-plugin-mungeUpgrade pmix-testUpgrade pmixUpgrade libmca_common_dstore1Upgrade pmix-develUpgrade pmix-pluginsUpgrade pmix-headersUpgrade pmix-mca-params | Sep 29, 2023 | Sep 9, 2023 |
| Ubuntu | — | Upgrade libpmi1-pmix (Ubuntu Pro)Upgrade libpmix-bin (Ubuntu Pro)Upgrade python3-pmix (Ubuntu Pro)Upgrade libpmi2-pmix (Ubuntu Pro)Upgrade libpmix2 (Ubuntu Pro) | Oct 19, 2023 | Sep 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub