CVE-2017-16816
The MITRE CVE dictionary describes this issue as:
The condor_schedd component in HTCondor before 8.6.8 and 8.7.x before 8.7.5 allows remote authenticated users to cause a denial of service (daemon crash) by leveraging use of GSI and VOMS extensions.
Find out more about CVE-2017-16816 from the MITRE CVE dictionary dictionary and NIST NVD.
Statement
Condor in Red Hat Enterprise MRG is built with both GSI and VOMS disabled and therefore is not affected by this issue.
CVSS v3 metrics
NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.
| CVSS3 Base Score | 6.5 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity Impact | None |
| Availability Impact | High |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat Enterprise MRG 2 | condor | Not affected |
Acknowledgements
Red Hat would like to thank the HTCondor project for reporting this issue.External References
CVE description copyright © 2017, The MITRE Corporation