Description
Cumin in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0 records broker authentication credentials in a log file, which allows local users to bypass authentication and perform unauthorized actions on jobs and message queues via a direct connection to the broker.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | condor +5 | 7.6.3-0.3.el5 | RHSA-2011:1250, RHSA-2011:1249 |
| Red Hat MRG 2 | condor-job-hooks +1 | 1.5-4.el5 | RHSA-2011:1250, RHSA-2011:1249 |
| Red Hat MRG 2 | condor-low-latency +1 | 1.2-2.el5 | RHSA-2011:1250, RHSA-2011:1249 |
| Red Hat MRG 2 | condor-wallaby +3 | 4.1-4.el5 | RHSA-2011:1250, RHSA-2011:1249 |
| Red Hat MRG 2 | condor-wallaby-base-db | 1.14-1.el5 | RHSA-2011:1250, RHSA-2011:1249 |
| Red Hat MRG 2 | cumin | 0.1.4916-1.el5 | RHSA-2011:1250, RHSA-2011:1249 |
| Red Hat MRG 2 | python-condorec2e +1 | 1.2-3.el5 | RHSA-2011:1250, RHSA-2011:1249 |
| Red Hat MRG 2 | ruby-rhubarb | 0.4.0-1.el5 | RHSA-2011:1250, RHSA-2011:1249 |
| Red Hat MRG 2 | wallaby +2 | 0.10.5-6.el5 | RHSA-2011:1250, RHSA-2011:1249 |
Advisories 2
- RHSA-2011:1250 Red Hat Security Advisory: Red Hat Enterprise MRG Grid 2.0 security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2011:1249 Red Hat Security Advisory: Red Hat Enterprise MRG Grid 2.0 security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- 1026021 vdb-entry
- 45928 third-party-advisory
- 49500 vdb-entry
- 75217 vdb-entry
- 45887 third-party-advisory
- RHSA-2011:1250 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=731574
- RHSA-2011:1249 vendor-advisory
- cumin-log-files-sec-bypass(69659) vdb-entry