Description
Condor before 7.0.4 does not properly handle wildcards in the ALLOW_WRITE, DENY_WRITE, HOSTALLOW_WRITE, or HOSTDENY_WRITE configuration variables in authorization policy lists, which might allow remote attackers to bypass intended access restrictions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 1 | condor +1 | 7.0.4-4.el4 | RHSA-2008:0816, RHSA-2008:0814 |
Advisories 2
- RHSA-2008:0816 Red Hat Security Advisory: condor security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2008:0814 Red Hat Security Advisory: condor security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 31423 third-party-advisory
- RHSA-2008:0816 vendor-advisory
- 31459 third-party-advisory
- FEDORA-2008-7205 vendor-advisory
- condor-authpolicy-security-bypass(44063) vdb-entry
- 1020646 vdb-entry
- http://www.cs.wisc.edu/condor/manual/v7.0/8_3Stable_Release.html#sec:New-7-0-4
- 30440 vdb-entry
- 31284 third-party-advisory
- RHSA-2008:0814 vendor-advisory