{"id":"OESA-2026-1348","summary":"munge security update","details":"MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating\nand validating credentials. It is designed to be highly scalable for use\nin an HPC cluster environment.\nIt allows a process to authenticate the UID and GID of another local or\nremote process within a group of hosts having common users and groups.\nThese hosts form a security realm that is defined by a shared cryptographic\nkey. Clients within this security realm can create and validate credentials\nwithout the use of root privileges, reserved ports, or platform-specific\nmethods.\r\n\r\nSecurity Fix(es):\n\nMUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process memory. With the leaked key material, the attacker could forge arbitrary MUNGE credentials to impersonate any user (including root) to services that rely on MUNGE for authentication. The vulnerability allows a buffer overflow by sending a crafted message with an oversized address length field, corrupting munged's internal state and enabling extraction of the MAC subkey used for credential verification. This vulnerability is fixed in 0.5.18.(CVE-2026-25506)","modified":"2026-02-13T14:00:21.683936Z","published":"2026-02-13T13:15:49Z","upstream":["CVE-2026-25506"],"database_specific":{"severity":"High"},"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1348"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25506"}],"affected":[{"package":{"name":"munge","ecosystem":"openEuler:20.03-LTS-SP4","purl":"pkg:rpm/openEuler/munge&distro=openEuler-20.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.14-2.oe2003sp4"}]}],"ecosystem_specific":{"x86_64":["munge-0.5.14-2.oe2003sp4.x86_64.rpm","munge-debuginfo-0.5.14-2.oe2003sp4.x86_64.rpm","munge-debugsource-0.5.14-2.oe2003sp4.x86_64.rpm","munge-devel-0.5.14-2.oe2003sp4.x86_64.rpm","munge-libs-0.5.14-2.oe2003sp4.x86_64.rpm"],"aarch64":["munge-0.5.14-2.oe2003sp4.aarch64.rpm","munge-debuginfo-0.5.14-2.oe2003sp4.aarch64.rpm","munge-debugsource-0.5.14-2.oe2003sp4.aarch64.rpm","munge-devel-0.5.14-2.oe2003sp4.aarch64.rpm","munge-libs-0.5.14-2.oe2003sp4.aarch64.rpm"],"src":["munge-0.5.14-2.oe2003sp4.src.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-1348.json"}},{"package":{"name":"munge","ecosystem":"openEuler:22.03-LTS-SP4","purl":"pkg:rpm/openEuler/munge&distro=openEuler-22.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.14-2.oe2203sp4"}]}],"ecosystem_specific":{"x86_64":["munge-0.5.14-2.oe2203sp4.x86_64.rpm","munge-debuginfo-0.5.14-2.oe2203sp4.x86_64.rpm","munge-debugsource-0.5.14-2.oe2203sp4.x86_64.rpm","munge-devel-0.5.14-2.oe2203sp4.x86_64.rpm","munge-libs-0.5.14-2.oe2203sp4.x86_64.rpm"],"aarch64":["munge-0.5.14-2.oe2203sp4.aarch64.rpm","munge-debuginfo-0.5.14-2.oe2203sp4.aarch64.rpm","munge-debugsource-0.5.14-2.oe2203sp4.aarch64.rpm","munge-devel-0.5.14-2.oe2203sp4.aarch64.rpm","munge-libs-0.5.14-2.oe2203sp4.aarch64.rpm"],"src":["munge-0.5.14-2.oe2203sp4.src.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-1348.json"}},{"package":{"name":"munge","ecosystem":"openEuler:24.03-LTS","purl":"pkg:rpm/openEuler/munge&distro=openEuler-24.03-LTS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.15-2.oe2403sp3"}]}],"ecosystem_specific":{"x86_64":["munge-0.5.15-2.oe2403.x86_64.rpm","munge-debuginfo-0.5.15-2.oe2403.x86_64.rpm","munge-debugsource-0.5.15-2.oe2403.x86_64.rpm","munge-devel-0.5.15-2.oe2403.x86_64.rpm","munge-libs-0.5.15-2.oe2403.x86_64.rpm","munge-0.5.15-2.oe2403sp1.x86_64.rpm","munge-debuginfo-0.5.15-2.oe2403sp1.x86_64.rpm","munge-debugsource-0.5.15-2.oe2403sp1.x86_64.rpm","munge-devel-0.5.15-2.oe2403sp1.x86_64.rpm","munge-libs-0.5.15-2.oe2403sp1.x86_64.rpm","munge-0.5.15-2.oe2403sp2.x86_64.rpm","munge-debuginfo-0.5.15-2.oe2403sp2.x86_64.rpm","munge-debugsource-0.5.15-2.oe2403sp2.x86_64.rpm","munge-devel-0.5.15-2.oe2403sp2.x86_64.rpm","munge-libs-0.5.15-2.oe2403sp2.x86_64.rpm","munge-0.5.15-2.oe2403sp3.x86_64.rpm","munge-debuginfo-0.5.15-2.oe2403sp3.x86_64.rpm","munge-debugsource-0.5.15-2.oe2403sp3.x86_64.rpm","munge-devel-0.5.15-2.oe2403sp3.x86_64.rpm","munge-libs-0.5.15-2.oe2403sp3.x86_64.rpm"],"aarch64":["munge-0.5.15-2.oe2403.aarch64.rpm","munge-debuginfo-0.5.15-2.oe2403.aarch64.rpm","munge-debugsource-0.5.15-2.oe2403.aarch64.rpm","munge-devel-0.5.15-2.oe2403.aarch64.rpm","munge-libs-0.5.15-2.oe2403.aarch64.rpm","munge-0.5.15-2.oe2403sp1.aarch64.rpm","munge-debuginfo-0.5.15-2.oe2403sp1.aarch64.rpm","munge-debugsource-0.5.15-2.oe2403sp1.aarch64.rpm","munge-devel-0.5.15-2.oe2403sp1.aarch64.rpm","munge-libs-0.5.15-2.oe2403sp1.aarch64.rpm","munge-0.5.15-2.oe2403sp2.aarch64.rpm","munge-debuginfo-0.5.15-2.oe2403sp2.aarch64.rpm","munge-debugsource-0.5.15-2.oe2403sp2.aarch64.rpm","munge-devel-0.5.15-2.oe2403sp2.aarch64.rpm","munge-libs-0.5.15-2.oe2403sp2.aarch64.rpm","munge-0.5.15-2.oe2403sp3.aarch64.rpm","munge-debuginfo-0.5.15-2.oe2403sp3.aarch64.rpm","munge-debugsource-0.5.15-2.oe2403sp3.aarch64.rpm","munge-devel-0.5.15-2.oe2403sp3.aarch64.rpm","munge-libs-0.5.15-2.oe2403sp3.aarch64.rpm"],"src":["munge-0.5.15-2.oe2403.src.rpm","munge-0.5.15-2.oe2403sp1.src.rpm","munge-0.5.15-2.oe2403sp2.src.rpm","munge-0.5.15-2.oe2403sp3.src.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-1348.json"}},{"package":{"name":"munge","ecosystem":"openEuler:24.03-LTS-SP1","purl":"pkg:rpm/openEuler/munge&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.15-2.oe2403sp1"}]}],"ecosystem_specific":{"x86_64":["munge-0.5.15-2.oe2403sp1.x86_64.rpm","munge-debuginfo-0.5.15-2.oe2403sp1.x86_64.rpm","munge-debugsource-0.5.15-2.oe2403sp1.x86_64.rpm","munge-devel-0.5.15-2.oe2403sp1.x86_64.rpm","munge-libs-0.5.15-2.oe2403sp1.x86_64.rpm"],"aarch64":["munge-0.5.15-2.oe2403sp1.aarch64.rpm","munge-debuginfo-0.5.15-2.oe2403sp1.aarch64.rpm","munge-debugsource-0.5.15-2.oe2403sp1.aarch64.rpm","munge-devel-0.5.15-2.oe2403sp1.aarch64.rpm","munge-libs-0.5.15-2.oe2403sp1.aarch64.rpm"],"src":["munge-0.5.15-2.oe2403sp1.src.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-1348.json"}},{"package":{"name":"munge","ecosystem":"openEuler:24.03-LTS-SP2","purl":"pkg:rpm/openEuler/munge&distro=openEuler-24.03-LTS-SP2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.15-2.oe2403sp2"}]}],"ecosystem_specific":{"x86_64":["munge-0.5.15-2.oe2403sp2.x86_64.rpm","munge-debuginfo-0.5.15-2.oe2403sp2.x86_64.rpm","munge-debugsource-0.5.15-2.oe2403sp2.x86_64.rpm","munge-devel-0.5.15-2.oe2403sp2.x86_64.rpm","munge-libs-0.5.15-2.oe2403sp2.x86_64.rpm"],"aarch64":["munge-0.5.15-2.oe2403sp2.aarch64.rpm","munge-debuginfo-0.5.15-2.oe2403sp2.aarch64.rpm","munge-debugsource-0.5.15-2.oe2403sp2.aarch64.rpm","munge-devel-0.5.15-2.oe2403sp2.aarch64.rpm","munge-libs-0.5.15-2.oe2403sp2.aarch64.rpm"],"src":["munge-0.5.15-2.oe2403sp2.src.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-1348.json"}},{"package":{"name":"munge","ecosystem":"openEuler:24.03-LTS-SP3","purl":"pkg:rpm/openEuler/munge&distro=openEuler-24.03-LTS-SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.15-2.oe2403sp3"}]}],"ecosystem_specific":{"x86_64":["munge-0.5.15-2.oe2403sp3.x86_64.rpm","munge-debuginfo-0.5.15-2.oe2403sp3.x86_64.rpm","munge-debugsource-0.5.15-2.oe2403sp3.x86_64.rpm","munge-devel-0.5.15-2.oe2403sp3.x86_64.rpm","munge-libs-0.5.15-2.oe2403sp3.x86_64.rpm"],"aarch64":["munge-0.5.15-2.oe2403sp3.aarch64.rpm","munge-debuginfo-0.5.15-2.oe2403sp3.aarch64.rpm","munge-debugsource-0.5.15-2.oe2403sp3.aarch64.rpm","munge-devel-0.5.15-2.oe2403sp3.aarch64.rpm","munge-libs-0.5.15-2.oe2403sp3.aarch64.rpm"],"src":["munge-0.5.15-2.oe2403sp3.src.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-1348.json"}}],"schema_version":"1.7.3"}