SB2022052411 - Multiple vulnerabilities in HTCondor

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2021-45103)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files. A remote user can access files stored in S3 cloud storage.

2) Inadequate Encryption Strength (CVE-ID: CVE-2021-45104)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists when HTCondor daemons are configured to use BLOWFISH or 3DES encryption and match password authentication is enabled. A remote attacker can capture network traffic between a condor_schedd and a condor_startd or condor_collector and gain access to sensitive information.

Remediation

Install update from vendor's website.

References

• https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0005/
• https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0001
• https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2021-0006/
• https://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2022-0002