{"id":"USN-6434-1","summary":"pmix vulnerability","details":"Francois Diakhate discovered that PMIx did not properly handle race \nconditions in the pmix library, which could lead to unwanted privilege\nescalation. An attacker could possibly use this issue to obtain ownership\nof an arbitrary file on the filesystem, under the default configuration\nof the application.\n","modified":"2026-04-27T16:54:43.552858Z","published":"2023-10-17T15:54:31Z","related":["UBUNTU-CVE-2023-41915"],"upstream":["CVE-2023-41915","UBUNTU-CVE-2023-41915"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-6434-1"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2023-41915"}],"affected":[{"package":{"name":"pmix","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/pmix@2.1.1~rc1-1ubuntu0.1~esm1?arch=source&distro=esm-apps/bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1~rc1-1ubuntu0.1~esm1"}]}],"versions":["2.1.0~rc1-1","2.1.0~rc1-2","2.1.0~rc1-3","2.1.0-1","2.1.0-2","2.1.1~rc1-1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"libpmi1-pmix","binary_version":"2.1.1~rc1-1ubuntu0.1~esm1"},{"binary_version":"2.1.1~rc1-1ubuntu0.1~esm1","binary_name":"libpmi2-pmix"},{"binary_name":"libpmix2","binary_version":"2.1.1~rc1-1ubuntu0.1~esm1"}]},"database_specific":{"cves_map":{"cves":[{"id":"CVE-2023-41915","severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:Pro:18.04:LTS"},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6434-1.json"}},{"package":{"name":"pmix","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/pmix@3.1.5-1ubuntu0.1~esm1?arch=source&distro=esm-apps/focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-1ubuntu0.1~esm1"}]}],"versions":["3.1.4-1","3.1.4-1build1","3.1.5-1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"libpmi1-pmix","binary_version":"3.1.5-1ubuntu0.1~esm1"},{"binary_version":"3.1.5-1ubuntu0.1~esm1","binary_name":"libpmi2-pmix"},{"binary_name":"libpmix2","binary_version":"3.1.5-1ubuntu0.1~esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6434-1.json","cves_map":{"cves":[{"id":"CVE-2023-41915","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"score":"medium","type":"Ubuntu"}]}],"ecosystem":"Ubuntu:Pro:20.04:LTS"}}},{"package":{"name":"pmix","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/pmix@4.1.2-2ubuntu1+esm1?arch=source&distro=esm-apps/jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-2ubuntu1+esm1"}]}],"versions":["4.1.0-3ubuntu1","4.1.0-3ubuntu2","4.1.1~rc6-1ubuntu1","4.1.2-2ubuntu1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro: https://ubuntu.com/pro","binaries":[{"binary_name":"libpmix-bin","binary_version":"4.1.2-2ubuntu1+esm1"},{"binary_name":"libpmix2","binary_version":"4.1.2-2ubuntu1+esm1"},{"binary_name":"python3-pmix","binary_version":"4.1.2-2ubuntu1+esm1"}]},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:22.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2023-41915"}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6434-1.json"}}],"schema_version":"1.7.5"}