What’s Vulnerable › Vulnerabilities

CVE-2017-16816

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-07-05 · updated 2026-06-17
• Weakness: CWE-20

Description

The condor_schedd component in HTCondor before 8.6.8 and 8.7.x before 8.7.5 allows remote authenticated users to cause a denial of service (daemon crash) by leveraging use of GSI and VOMS extensions.

Affected products

• HTCondor: before 8.6.8; from 8.7.0 before 8.7.5 — fixed in 8.6.8, 8.7.5

How to fix

Upgrade to a fixed version: HTCondor 8.6.8, 8.7.5. Check the vendor advisory for mitigations.

References

• http://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2017-0001.html
• https://www-auth.cs.wisc.edu/lists/htcondor-users/2017-November/msg00022.shtml
• http://research.cs.wisc.edu/htcondor/security/vulnerabilities/HTCONDOR-2017-0001.html
• https://www-auth.cs.wisc.edu/lists/htcondor-users/2017-November/msg00022.shtml

Get alerted when CVE-2017-16816 or the next vulnerability affects your stack