{"id":"CVE-2023-41915","aliases":["ALSA-2024:2199","ALSA-2024:3008","AZL-29702","CLSA-2025-1763123299","DEBIAN-CVE-2023-41915","DLA-3643-1","DSA-5547-1","EUVD-2023-46393","GHSA-m8fg-c37h-w29q","MGASA-2024-0162","OESA-2023-1676","RHSA-2024:2199","RHSA-2024:3008","RLSA-2024:2199","RLSA-2024:3008","SUSE-SU-2023:3859-1","UBUNTU-CVE-2023-41915","USN-6434-1","openSUSE-SU-2024:13223-1"],"status":"published","title":"OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of...","description":"OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01226,"percentile":0.69209,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2023-09-09T00:00:00Z","modified":"2026-10-29T11:31:42Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"pmix","fixed_in":["3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"pmix-devel","fixed_in":["3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"pmix-pmi","fixed_in":["3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"pmix-pmi-devel","fixed_in":["3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"pmix-tools","fixed_in":["3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"pmix","fixed_in":["2.2.5-3.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"pmix-devel","fixed_in":["2.2.5-3.el8"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"pmix","fixed_in":["4.1.3-1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"pmix","fixed_in":["3.2.3-3.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"pmix-devel","fixed_in":["3.2.3-3.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"pmix-pmi","fixed_in":["3.2.3-3.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"pmix-pmi-devel","fixed_in":["3.2.3-3.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"pmix-tools","fixed_in":["3.2.3-3.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"pmix","fixed_in":["4.2.2-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pmix","fixed_in":["5.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pmix","fixed_in":["5.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"pmix","fixed_in":["3.1.2-3+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"pmix","fixed_in":["4.0.0-4.1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"openpmix","fixed_in":["4.2.3-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"pmix","fixed_in":["4.2.6-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"pmix","fixed_in":["4.2.6-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"pmix","fixed_in":["4.2.6-1.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"pmix","fixed_in":["4.2.6-1.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"pmix","fixed_in":["4.2.6-1.oe2203sp2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pmix","fixed_in":["0:3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pmix-debuginfo","fixed_in":["0:3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pmix-debugsource","fixed_in":["0:3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pmix-devel","fixed_in":["0:3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pmix-pmi","fixed_in":["0:3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pmix-pmi-debuginfo","fixed_in":["0:3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pmix-tools","fixed_in":["0:3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pmix-tools-debuginfo","fixed_in":["0:3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"pmix-debuginfo","fixed_in":["0:3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"pmix-debugsource","fixed_in":["0:3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"pmix-pmi-debuginfo","fixed_in":["0:3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"pmix-pmi-devel","fixed_in":["0:3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"pmix-tools-debuginfo","fixed_in":["0:3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pmix","fixed_in":["0:2.2.5-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pmix-debuginfo","fixed_in":["0:2.2.5-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pmix-debugsource","fixed_in":["0:2.2.5-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"pmix-debuginfo","fixed_in":["0:2.2.5-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"pmix-debugsource","fixed_in":["0:2.2.5-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"pmix-devel","fixed_in":["0:2.2.5-3.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"pmix","fixed_in":["0:3.2.3-5.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"pmix","fixed_in":["0:2.2.5-3.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP4","package":"pmix","fixed_in":["3.2.3-150300.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP5","package":"pmix","fixed_in":["3.2.3-150300.3.8.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"pmix","fixed_in":["3.2.3-150300.3.8.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"pmix","fixed_in":["3.2.3-150300.3.8.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pmix","fixed_in":["2.1.1~rc1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"pmix","fixed_in":["4.1.2-2ubuntu1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pmix","fixed_in":["3.1.5-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pmix-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pmix-pmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pmix-pmi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pmix-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"pmix-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.5-3.el8"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-3.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"pmix-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-3.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"pmix-pmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-3.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"pmix-pmi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-3.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"pmix-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-3.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-1+deb12u1"}]}],"versions":["4.2.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-3+deb10u1"}]}],"versions":["3.1.2-3"]},{"source":"osv","ecosystem":"Debian:11","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-4.1+deb11u1"}]}],"versions":["4.0.0-4.1"]},{"source":"osv","ecosystem":"Debian:12","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-1+deb12u1"}]}],"versions":["4.2.2-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"openpmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6-1.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6-1.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6-1.oe2203sp2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pmix-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pmix-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pmix-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pmix-pmi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pmix-pmi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pmix-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pmix-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"pmix-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"pmix-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"pmix-pmi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"pmix-pmi-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"pmix-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pmix-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"pmix-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"pmix-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"pmix-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"pmix-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-3.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-5.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.5-3.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP4","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150300.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP5","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150300.3.8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150300.3.8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150300.3.8.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1~rc1-1ubuntu0.1~esm1"}]}],"versions":["2.1.0~rc1-1","2.1.0~rc1-2","2.1.0~rc1-3","2.1.0-1","2.1.0-2","2.1.1~rc1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-2ubuntu1+esm1"}]}],"versions":["4.1.0-3ubuntu1","4.1.0-3ubuntu2","4.1.1~rc6-1ubuntu1","4.1.2-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1~rc1-1ubuntu0.1~esm1"}]}],"versions":["2.1.0~rc1-1","2.1.0~rc1-2","2.1.0~rc1-3","2.1.0-1","2.1.0-2","2.1.1~rc1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.5-1ubuntu0.1~esm1"}]}],"versions":["3.1.4-1","3.1.4-1build1","3.1.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"pmix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-2ubuntu1+esm1"}]}],"versions":["4.1.0-3ubuntu1","4.1.0-3ubuntu2","4.1.1~rc6-1ubuntu1","4.1.2-2ubuntu1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"openpmix","product":"openpmix"}],"references":[{"url":"https://docs.openpmix.org/en/latest/security.html","tags":["x_transferred","Not Applicable","web","report"]},{"url":"https://github.com/openpmix/openpmix/releases/tag/v5.0.1","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://github.com/openpmix/openpmix/releases/tag/v4.2.6","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFKIY6SNC3KQNZMVROWMIW6DI5XPNKQX/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYJ7IRNR6NHJMTNOV3E3W3D5MLDRDCJX/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDLWSMQYXF2ZGOQKCG26H6ZZA5FEH7HX/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00048.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://www.debian.org/security/2023/dsa-5547","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/10/3","tags":["mailing-list","x_transferred","article"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/10/4","tags":["mailing-list","x_transferred","article"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/10/6","tags":["mailing-list","x_transferred","article"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/11/3","tags":["mailing-list","x_transferred","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41915","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IFKIY6SNC3KQNZMVROWMIW6DI5XPNKQX"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYJ7IRNR6NHJMTNOV3E3W3D5MLDRDCJX"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YDLWSMQYXF2ZGOQKCG26H6ZZA5FEH7HX"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFKIY6SNC3KQNZMVROWMIW6DI5XPNKQX"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYJ7IRNR6NHJMTNOV3E3W3D5MLDRDCJX"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YDLWSMQYXF2ZGOQKCG26H6ZZA5FEH7HX"},{"url":"https://github.com/advisories/GHSA-m8fg-c37h-w29q"},{"url":"https://access.redhat.com/errata/RHSA-2024:2199","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41915","tags":["report"]},{"url":"https://bugzilla.redhat.com/2238898","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2199.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3008","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-3008.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1763123299.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41915.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-41915","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0162.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33160","tags":["report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1676","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238898","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2199.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41915","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3008.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:2199","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:3008","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233859-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215190","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41915","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-41915","tags":["report"]},{"url":"https://github.com/openpmix/openpmix/commit/da036933c2795c1f40d0835e15f17e204e4daf0f","tags":["report"]},{"url":"https://github.com/openpmix/openpmix/commit/0bf9801a3017eb6ca411e158da39570ccb998c17","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6434-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-41915","description":"OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.","status":"published","published":"2023-09-09T00:00:00Z","modified":"2024-08-02T19:09:49.401Z","updated_at":"2026-11-02T14:35:18.88314Z"}],"euvd":[{"id":"EUVD-2023-46393","description":"OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.","status":"published","published":"2023-09-09T00:00:00Z","modified":"2024-08-02T19:09:49Z","updated_at":"2026-11-03T03:50:01.043754Z"}],"ghsa":[{"id":"GHSA-m8fg-c37h-w29q","title":"OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of...","description":"OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.","status":"published","published":"2023-09-10T00:30:12Z","modified":"2024-07-11T15:30:41Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:57:40.937292Z"}],"nvd":[{"id":"CVE-2023-41915","description":"OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.","status":"published","published":"2023-09-09T22:15:09.53Z","modified":"2026-06-17T06:23:03.857Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:08:28.268644Z"}],"osv":[{"id":"AZL-29702","title":"CVE-2023-41915 affecting package pmix for versions less than 4.1.3-1","description":"OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.","status":"published","published":"2023-09-09T22:15:09Z","modified":"2026-04-21T04:26:01.265156Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"DEBIAN-CVE-2023-41915","description":"OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.","status":"published","published":"2023-09-09T22:15:09.53Z","modified":"2026-10-26T18:03:06.917286086Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"OESA-2023-1676","title":"pmix security update","description":"PMI has been used for quite some time as a means of exchanging wireup information needed for interprocess communication.\r\n\r\nSecurity Fix(es):\r\n\r\nOpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.(CVE-2023-41915)","status":"published","published":"2023-09-22T11:06:07Z","modified":"2026-08-18T01:17:05.653636885Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"RHSA-2024:2199","title":"Red Hat Security Advisory: pmix security update","status":"published","published":"2024-09-16T15:50:43Z","modified":"2026-06-30T10:07:06Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3008","title":"Red Hat Security Advisory: pmix security update","status":"published","published":"2024-09-16T15:50:52Z","modified":"2026-06-30T10:07:30Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RLSA-2024:2199","title":"Important: pmix security update","description":"The Process Management Interface (PMI) provides process management functions for MPI implementations. PMI Exascale (PMIx) provides an extended version of the PMI standard specifically designed to support clusters up to and including exascale sizes.\n\nSecurity Fix(es):\n\n* pmix: race condition allows attackers to obtain ownership of arbitrary files (CVE-2023-41915)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section.","status":"published","published":"2025-05-07T19:13:05.465265Z","modified":"2025-10-07T17:38:04.248257Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2023-41915","description":"OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.","status":"published","published":"2023-09-09T22:15:00Z","modified":"2026-04-22T14:11:56.529052Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"ALSA-2024:2199","title":"Important: pmix security update","description":"The Process Management Interface (PMI) provides process management functions for MPI implementations. PMI Exascale (PMIx) provides an extended version of the PMI standard specifically designed to support clusters up to and including exascale sizes.\n\nSecurity Fix(es):\n\n* pmix: race condition allows attackers to obtain ownership of arbitrary files (CVE-2023-41915)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:42.042420384Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:3008","title":"Important: pmix security update","description":"The Process Management Interface (PMI) provides process management functions for MPI implementations. PMI Exascale (PMIx) provides an extended version of the PMI standard specifically designed to support clusters up to and including exascale sizes.\n\nSecurity Fix(es):\n\n* pmix: race condition allows attackers to obtain ownership of arbitrary files (CVE-2023-41915)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-05-22T00:00:00Z","modified":"2026-10-29T11:02:20.802135131Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2025-1763123299","title":"pmix: Fix of CVE-2023-41915","description":"- CVE-2023-41915: prevent attackers from obtaining ownership of arbitrary files\n  by fixing race condition during execution of library code with UID 0","status":"published","published":"2025-11-14T12:28:23Z","modified":"2026-06-01T00:31:25.705647621Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CVE-2023-41915","description":"OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.","status":"published","published":"2023-09-09T00:00:00Z","modified":"2026-10-28T02:31:08.233218077Z","updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"DLA-3643-1","title":"pmix - security update","status":"published","published":"2023-10-31T00:00:00Z","modified":"2026-03-09T01:19:55.290799Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5547-1","title":"pmix - security update","status":"published","published":"2023-11-04T00:00:00Z","modified":"2026-03-09T02:09:48.308301Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2024-0162","title":"Updated openpmix packages fix security vulnerability","description":"This update fixes a race condition allowing attackers to obtain\nownership of arbitrary files (CVE-2023-41915).\n","status":"published","published":"2024-05-09T02:40:29Z","modified":"2026-04-16T04:44:21.70793546Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13223-1","title":"libmca_common_dstore1-3.2.3-11.1 on GA media","description":"These are all security issues fixed in the libmca_common_dstore1-3.2.3-11.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:52:20.590386Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"RLSA-2024:3008","title":"Important: pmix security update","description":"The Process Management Interface (PMI) provides process management functions for MPI implementations. PMI Exascale (PMIx) provides an extended version of the PMI standard specifically designed to support clusters up to and including exascale sizes.\n\nSecurity Fix(es):\n\n* pmix: race condition allows attackers to obtain ownership of arbitrary files (CVE-2023-41915)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.","status":"published","published":"2024-06-14T13:59:30.118978Z","modified":"2026-02-05T11:00:03.958089Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2023:3859-1","title":"Security update for pmix","description":"This update for pmix fixes the following issues:\n\n- CVE-2023-41915: Fixed a potential vulnerability where a `chown` may follow a\n  user-created link (bsc#1215190).\n\n- Install pmix-plugin-munge if munge is installed.","status":"published","published":"2023-09-28T09:18:03Z","modified":"2026-02-04T04:05:07.290314Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"USN-6434-1","title":"pmix vulnerability","description":"Francois Diakhate discovered that PMIx did not properly handle race \nconditions in the pmix library, which could lead to unwanted privilege\nescalation. An attacker could possibly use this issue to obtain ownership\nof an arbitrary file on the filesystem, under the default configuration\nof the application.\n","status":"published","published":"2023-10-17T15:54:31Z","modified":"2026-04-27T16:54:43.552858Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}