Description
The policy definition evaluator in Condor 7.5.4, 8.0.0, and earlier does not properly handle attributes in a (1) PREEMPT, (2) SUSPEND, (3) CONTINUE, (4) WANT_VACATE, or (5) KILL policy that evaluate to an Unconfigured, Undefined, or Error state, which allows remote authenticated users to cause a denial of service (condor_startd exit) via a crafted job.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | condor | 8.0.5~dfsg.1-1 | — |
| Debian 13 | condor | 8.0.5~dfsg.1-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | condor +5 | 7.8.8-0.4.2.el5_9 | RHSA-2013:1172, RHSA-2013:1171 |
| Red Hat MRG 2 | condor-plumage +2 | 7.8.8-0.4.3.el6_4 | RHSA-2013:1172 |
Advisories 2
- RHSA-2013:1172 Red Hat Security Advisory: condor security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2013:1171 Red Hat Security Advisory: condor security update Red Hat Security Advisories (RHSA) · Jun 26, 2026