Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -1 articles for you...
87
security advisorydebianprivilege escalationDebian: DSA-5547-1 Critical PMIx Race Condition Privilege Escalation
Francois Diakhate reported that a race condition in pmix, a library implementing Process Management Interface (PMI) Exascale API, could allow a malicious user to obtain ownership of an arbitrary file on the filesystem when parts of the PMIx library are called by a process with . - ------------------------------------------------------------------------- Debian Security Advisory DSA-5547-1
Nov 04, 2023
•Critical
Debian
197
security advisorymoderatedebianDebian 10 DLA-3643-1 Moderate Pmix Arbitrary File Overwrite
It was discovered that there was an arbitrary file overwrite vulnerability in pmix, a library used in parallel/cluster computing. Attackers could have obtained ownership of arbitrary files via a . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3643-1
Oct 31, 2023
Debian LTS
172
security advisorymoderatefile overwriteUbuntu: 6434-1 Moderate: PMIx File Overwrite And Escalation Risk
PMIx could be made to overwrite files.. ========================================================================== Ubuntu Security Notice USN-6434-1 October 17, 2023 pmix vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS (Available with Ubuntu Pro) - Ubuntu 20.04 LTS (Available with Ubuntu Pro) - Ubuntu 18.04 LTS (Available with Ubuntu Pro) Summary: PMIx could be made to overwrite files. Software Description: - pmix: Process Management Interface (Exascale) library - tools Details: Francois Diakhate discovered that PMIx did not properly handle race conditions in the pmix library, which could lead to unwanted privilege escalation. An attacker could possibly use this issue to obtain ownership of an arbitrary file on the filesystem, under the default configuration of the application. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS (Available with Ubuntu Pro): libpmix-bin 4.1.2-2ubuntu1+esm1 libpmix2 4.1.2-2ubuntu1+esm1 python3-pmix 4.1.2-2ubuntu1+esm1 Ubuntu 20.04 LTS (Available with Ubuntu Pro): libpmi1-pmix 3.1.5-1ubuntu0.1~esm1 libpmi2-pmix 3.1.5-1ubuntu0.1~esm1 libpmix2 3.1.5-1ubuntu0.1~esm1 Ubuntu 18.04 LTS (Available with Ubuntu Pro): libpmi1-pmix 2.1.1~rc1-1ubuntu0.1~esm1 libpmi2-pmix 2.1.1~rc1-1ubuntu0.1~esm1 libpmix2 2.1.1~rc1-1ubuntu0.1~esm1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6434-1 CVE-2023-41915 . A vulnerability in PMIx may allow for unintended file overwrites and potential escalation of privileges on Ubuntu platforms due toa race condition. Please ensure you update immediately.. PMIx, Ubuntu Security, File Overwrite, Escalation Risk, Update Instructions. . LinuxSecurity.com Team
Oct 18, 2023
Ubuntu
89
security advisorymoderateFedoraFedora 37: 2023-155d2f22f1 Moderate: PMIx Race Condition Fix
Security fix for CVE-2023-41915. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-155d2f22f1 2023-10-04 02:59:33.979957 -------------------------------------------------------------------------------- Name : pmix Product : Fedora 37 Version : 4.1.3 Release : 1.fc37 URL : https://pmix.org/ Summary : Process Management Interface Exascale (PMIx) Description : The Process Management Interface (PMI) has been used for quite some time as a means of exchanging wireup information needed for interprocess communication. Two versions (PMI-1 and PMI-2) have been released as part of the MPICH effort. While PMI-2 demonstrates better scaling properties than its PMI-1 predecessor, attaining rapid launch and wireup of the roughly 1M processes executing across 100k nodes expected for exascale operations remains challenging. PMI Exascale (PMIx) represents an attempt to resolve these questions by providing an extended version of the PMI standard specifically designed to support clusters up to and including exascale sizes. The overall objective of the project is not to branch the existing pseudo-standard definitions - in fact, PMIx fully supports both of the existing PMI-1 and PMI-2 APIs - but rather to (a) augment and extend those APIs to eliminate some current restrictions that impact scalability, and (b) provide a reference implementation of the PMI-server that demonstrates the desired level of scalability. -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2023-41915 -------------------------------------------------------------------------------- ChangeLog: * Thu Sep 14 2023 Michel Lind - 4.1.3-1 - Fix CVE-2023-41915 - Update upstream source URL; pmix/pmix redirects to openpmix/openpmix - Use SPDX license identifier * Fri Jul 21 2023 Fedora Release Engineering - 4.1.2-5 - Rebuilt forhttps://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Fri Jan 20 2023 Fedora Release Engineering - 4.1.2-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2238898 - CVE-2023-41915 pmix: race condition allows attackers to obtain ownership of arbitrary files https://bugzilla.redhat.com/show_bug.cgi?id=2238898 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-155d2f22f1' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Oct 04, 2023
Fedora
89
security advisoryFedoramoderate severityFedora 38: FEDORA-2023-d6dbdf62ad Moderate: Pmix Race Condition
Security fix for CVE-2023-41915. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-d6dbdf62ad 2023-10-04 02:33:28.911756 -------------------------------------------------------------------------------- Name : pmix Product : Fedora 38 Version : 4.1.3 Release : 1.fc38 URL : https://pmix.org/ Summary : Process Management Interface Exascale (PMIx) Description : The Process Management Interface (PMI) has been used for quite some time as a means of exchanging wireup information needed for interprocess communication. Two versions (PMI-1 and PMI-2) have been released as part of the MPICH effort. While PMI-2 demonstrates better scaling properties than its PMI-1 predecessor, attaining rapid launch and wireup of the roughly 1M processes executing across 100k nodes expected for exascale operations remains challenging. PMI Exascale (PMIx) represents an attempt to resolve these questions by providing an extended version of the PMI standard specifically designed to support clusters up to and including exascale sizes. The overall objective of the project is not to branch the existing pseudo-standard definitions - in fact, PMIx fully supports both of the existing PMI-1 and PMI-2 APIs - but rather to (a) augment and extend those APIs to eliminate some current restrictions that impact scalability, and (b) provide a reference implementation of the PMI-server that demonstrates the desired level of scalability. -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2023-41915 -------------------------------------------------------------------------------- ChangeLog: * Thu Sep 14 2023 Michel Lind - 4.1.3-1 - Fix CVE-2023-41915 - Update upstream source URL; pmix/pmix redirects to openpmix/openpmix - Use SPDX license identifier * Fri Jul 21 2023 Fedora Release Engineering - 4.1.2-5 - Rebuilt forhttps://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2238898 - CVE-2023-41915 pmix: race condition allows attackers to obtain ownership of arbitrary files https://bugzilla.redhat.com/show_bug.cgi?id=2238898 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-d6dbdf62ad' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Oct 04, 2023
Fedora
89
security advisoryupdateFedoraFedora: 2023-d6dbdf62ad Critical: OpenMPI Race Condition Fix
Security fix for CVE-2023-41915. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-d6dbdf62ad 2023-10-04 02:33:28.911756 -------------------------------------------------------------------------------- Name : openmpi Product : Fedora 38 Version : 4.1.4 Release : 9.fc38 URL : https://www.open-mpi.org/ Summary : Open Message Passing Interface Description : Open MPI is an open source, freely available implementation of both the MPI-1 and MPI-2 standards, combining technologies and resources from several other projects (FT-MPI, LA-MPI, LAM/MPI, and PACX-MPI) in order to build the best MPI library available. A completely new MPI-2 compliant implementation, Open MPI offers advantages for system and software vendors, application developers, and computer science researchers. For more information, see https://www.open-mpi.org/ . -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2023-41915 -------------------------------------------------------------------------------- ChangeLog: * Mon Sep 25 2023 Michel Lind - 4.1.4-9 - Rebuild for pmix 4.1.3 (bz#2240042) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2238898 - CVE-2023-41915 pmix: race condition allows attackers to obtain ownership of arbitrary files https://bugzilla.redhat.com/show_bug.cgi?id=2238898 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-d6dbdf62ad' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Oct 04, 2023
•Critical
Fedora
89
security advisorysecurity issuefedoraFedora 39: FEDORA-2023-1b25e7d001 Urgent: Pmix Concurrency Flaw
Security fix for CVE-2023-41915. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-1185eca900 2023-10-03 13:58:16.560534 -------------------------------------------------------------------------------- Name : pmix Product : Fedora 39 Version : 4.1.3 Release : 1.fc39 URL : https://pmix.org/ Summary : Process Management Interface Exascale (PMIx) Description : The Process Management Interface (PMI) has been used for quite some time as a means of exchanging wireup information needed for interprocess communication. Two versions (PMI-1 and PMI-2) have been released as part of the MPICH effort. While PMI-2 demonstrates better scaling properties than its PMI-1 predecessor, attaining rapid launch and wireup of the roughly 1M processes executing across 100k nodes expected for exascale operations remains challenging. PMI Exascale (PMIx) represents an attempt to resolve these questions by providing an extended version of the PMI standard specifically designed to support clusters up to and including exascale sizes. The overall objective of the project is not to branch the existing pseudo-standard definitions - in fact, PMIx fully supports both of the existing PMI-1 and PMI-2 APIs - but rather to (a) augment and extend those APIs to eliminate some current restrictions that impact scalability, and (b) provide a reference implementation of the PMI-server that demonstrates the desired level of scalability. -------------------------------------------------------------------------------- Update Information: Security fix for CVE-2023-41915 -------------------------------------------------------------------------------- ChangeLog: * Thu Sep 14 2023 Michel Lind - 4.1.3-1 - Fix CVE-2023-41915 - Update upstream source URL; pmix/pmix redirects to openpmix/openpmix - Use SPDX licenseidentifier -------------------------------------------------------------------------------- References: [ 1 ] Bug #2238898 - CVE-2023-41915 pmix: race condition allows attackers to obtain ownership of arbitrary files https://bugzilla.redhat.com/show_bug.cgi?id=2238898 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-1185eca900' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Oct 03, 2023
•Critical
Fedora
202
security advisorymoderate threatpatch managementopenSUSE 15.5: 2023:3859-1 Moderate: pmix User-Linked Chown Threat
This update for pmix fixes the following issues: CVE-2023-41915: Fixed a potential vulnerability where a `chown` may follow a user-created link (bsc#1215190).. # Security update for pmix Announcement ID: SUSE-SU-2023:3859-1 Rating: moderate References: * #1215190 Cross-References: * CVE-2023-41915 CVSS scores: * CVE-2023-41915 ( SUSE ): 6.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L * CVE-2023-41915 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products: * HPC Module 15-SP4 * HPC Module 15-SP5 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 An update that solves one vulnerability can now be installed. ## Description: This update for pmix fixes the following issues: * CVE-2023-41915: Fixed a potential vulnerability where a `chown` may follow a user-created link (bsc#1215190). * Install pmix-plugin-munge if munge is installed. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.4 zypper in -t patch openSUSE-SLE-15.4-2023-3859=1 * openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2023-3859=1 * HPC Module 15-SP4 zypper in -t patch SUSE-SLE-Module-HPC-15-SP4-2023-3859=1 * HPC Module 15-SP5 zypper in -t patch SUSE-SLE-Module-HPC-15-SP5-2023-3859=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64) * libpmix2-debuginfo-3.2.3-150300.3.8.1 * pmix-3.2.3-150300.3.8.1 * pmix-plugins-3.2.3-150300.3.8.1 * pmix-plugin-munge-3.2.3-150300.3.8.1 * pmix-test-debuginfo-3.2.3-150300.3.8.1 * pmix-plugins-debuginfo-3.2.3-150300.3.8.1 * libmca_common_dstore1-debuginfo-3.2.3-150300.3.8.1 * pmix-plugin-munge-debuginfo-3.2.3-150300.3.8.1 * pmix-test-3.2.3-150300.3.8.1 *libpmix2-3.2.3-150300.3.8.1 * libmca_common_dstore1-3.2.3-150300.3.8.1 * pmix-debuginfo-3.2.3-150300.3.8.1 * pmix-debugsource-3.2.3-150300.3.8.1 * pmix-devel-3.2.3-150300.3.8.1 * openSUSE Leap 15.4 (noarch) * pmix-headers-3.2.3-150300.3.8.1 * pmix-mca-params-3.2.3-150300.3.8.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * libpmix2-debuginfo-3.2.3-150300.3.8.1 * pmix-3.2.3-150300.3.8.1 * pmix-plugins-3.2.3-150300.3.8.1 * pmix-plugin-munge-3.2.3-150300.3.8.1 * pmix-test-debuginfo-3.2.3-150300.3.8.1 * pmix-plugins-debuginfo-3.2.3-150300.3.8.1 * libmca_common_dstore1-debuginfo-3.2.3-150300.3.8.1 * pmix-plugin-munge-debuginfo-3.2.3-150300.3.8.1 * pmix-test-3.2.3-150300.3.8.1 * libpmix2-3.2.3-150300.3.8.1 * libmca_common_dstore1-3.2.3-150300.3.8.1 * pmix-debuginfo-3.2.3-150300.3.8.1 * pmix-debugsource-3.2.3-150300.3.8.1 * pmix-devel-3.2.3-150300.3.8.1 * openSUSE Leap 15.5 (noarch) * pmix-headers-3.2.3-150300.3.8.1 * pmix-mca-params-3.2.3-150300.3.8.1 * HPC Module 15-SP4 (aarch64 x86_64) * libpmix2-debuginfo-3.2.3-150300.3.8.1 * pmix-3.2.3-150300.3.8.1 * pmix-plugins-3.2.3-150300.3.8.1 * pmix-plugin-munge-3.2.3-150300.3.8.1 * pmix-test-debuginfo-3.2.3-150300.3.8.1 * pmix-plugins-debuginfo-3.2.3-150300.3.8.1 * libmca_common_dstore1-debuginfo-3.2.3-150300.3.8.1 * pmix-plugin-munge-debuginfo-3.2.3-150300.3.8.1 * pmix-test-3.2.3-150300.3.8.1 * libpmix2-3.2.3-150300.3.8.1 * libmca_common_dstore1-3.2.3-150300.3.8.1 * pmix-debuginfo-3.2.3-150300.3.8.1 * pmix-debugsource-3.2.3-150300.3.8.1 * HPC Module 15-SP4 (noarch) * pmix-headers-3.2.3-150300.3.8.1 * pmix-mca-params-3.2.3-150300.3.8.1 * HPC Module 15-SP4 (x86_64) * pmix-devel-3.2.3-150300.3.8.1 * HPC Module 15-SP5 (aarch64 x86_64) * libpmix2-debuginfo-3.2.3-150300.3.8.1 * pmix-3.2.3-150300.3.8.1 * pmix-plugins-3.2.3-150300.3.8.1 * pmix-plugin-munge-3.2.3-150300.3.8.1 *pmix-test-debuginfo-3.2.3-150300.3.8.1 * pmix-plugins-debuginfo-3.2.3-150300.3.8.1 * libmca_common_dstore1-debuginfo-3.2.3-150300.3.8.1 * pmix-plugin-munge-debuginfo-3.2.3-150300.3.8.1 * pmix-test-3.2.3-150300.3.8.1 * libpmix2-3.2.3-150300.3.8.1 * libmca_common_dstore1-3.2.3-150300.3.8.1 * pmix-debuginfo-3.2.3-150300.3.8.1 * pmix-debugsource-3.2.3-150300.3.8.1 * HPC Module 15-SP5 (noarch) * pmix-headers-3.2.3-150300.3.8.1 * pmix-mca-params-3.2.3-150300.3.8.1 * HPC Module 15-SP5 (x86_64) * pmix-devel-3.2.3-150300.3.8.1 ## References: * https://www.suse.com/security/cve/CVE-2023-41915.html * https://bugzilla.suse.com/show_bug.cgi?id=1215190 . The latest pmix update tackles a potential vulnerability concerning user-generated links, reinforcing overall security measures.. openSUSE Update, pmix Security, Patching, Threat Mitigation, Linux Security. . LinuxSecurity.com Team
Sep 28, 2023
OpenSUSE
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!