HTCondor (CLAIMTOBE authentication method): MULTI-TENANT ISOLATION: Once a user has authenticated to a daemon with

Impact

MULTI-TENANT ISOLATION: Once a user has authenticated to a daemon with CLAIMTOBE - a method that amounts to asserting your own identity - every subsequent command on that connection can claim to be anyone. That includes submitting and controlling jobs as other tenants and issuing administrative commands.

Who can reach it

Anyone able to reach a daemon that lists CLAIMTOBE among its accepted methods. CLAIMTOBE has historically been in the default READ method list, so many pools are exposed without having chosen to be.

What to do

Upgrade to HTCondor 8.8.16, 9.0.10 or 9.6.0 and restart the daemons. Separately, strike CLAIMTOBE out of SEC_*_AUTHENTICATION_METHODS everywhere - there is no configuration in which it is a real authentication method, and doing this also closes the CLAIMTOBE half of CVE-2019-18823.

References