[QSA-0925262]
Security Update Bundle

Qlustar Security Advisory 0925262

September 25th, 2026

Summary:

A Qlustar security update bundle is a cumulative update of packages that are taken from upstream Debian/Ubuntu without modification. Only packages that are used in a typical HPC/Storage cluster installation are mentioned in Qlustar Security Advisories. Other non-HPC related updates also enter the Qlustar repository, but their functionality is not separately verified by the Qlustar team. To track these updates subscribe to the general security mailing lists of Debian/Ubuntu and/or AlmaLinux.

Package(s)       : see upstream description of individual package
Qlustar releases : 13, 14
Affected versions: All versions prior to this update
Vulnerability    : see upstream description of individual package
Problem type     : see upstream description of individual package
Qlustar-specific : no
CVE Id(s)        : see upstream description of individual package

This update includes several security related package updates from Debian/Ubuntu and AlmaLinux. The following list provides references to the upstream security report of the corresponding packages. You can view the original upstream advisory by clicking on the corresponding title.

Relevant to Qlustar 13 and/or 14 – Ubuntu

If an advisory applies only to Qlustar 13 or 14, it is noted in its description.

libpcap vulnerability

It was discovered that libpcap did not properly validate BPF instructions in some situation. An attacker could possibly use this issue to perform out of bound memory operations.

curl vulnerabilities

Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for LDAP authentication in certain circumstances. A machine-in-the-middle attacker could possibly use this issue to bypass peer validation. This issue only affected Qlustar 14.

Stephan Zeisberg discovered that curl incorrectly handled HTTP/2 Server Push streams when sharing connections between handles. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code.

Stanislav Fort discovered that curl did not properly enforce public key pinning when certificate verification was disabled in certain circumstances. A remote attacker could possibly use this issue to bypass pinning checks and cause curl to accept connections that should have been rejected.

Stanislav Fort discovered that curl did not properly enforce Public Suffix List boundaries when handling cookies in certain circumstances. A remote attacker could possibly use this issue to cause cookies to be sent to unrelated domains, resulting in sensitive information being exposed.

Expat vulnerabilities

It was discovered that Expat did not correctly handle certain integer arithmetic. An attacker could possibly use this issue to cause a denial of service.

It was discovered that Expat did not correctly track handler call depth. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code.

It was discovered that Expat did not correctly handle certain memory operations. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code.

It was discovered that Expat did not correctly handle certain Unicode characters. An attacker could possibly use this issue to cause Expat to use excessive resources, leading to a denial of service.

It was discovered that Expat did not correctly process certain XML attributes. A remote attacker could possibly use this issue to cause Expat to use excessive resources, leading to a denial of service.

It was discovered that Expat did not correctly handle certain external entities. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code.

It was discovered that Expat did not correctly track handler call depth with custom encodings. An attacker could possibly use this issue to cause Expat to crash or execute arbitrary code.

Sudo vulnerability

Guannan Wang, Zhanpeng Liu, and Guancheng Li discovered that Sudo failed to apply intercept policy checks when commands were executed under certain circumstances. A local attacker permitted to run specific commands could possibly use this issue to bypass policy enforcement and logging, executing unauthorized programs.

libssh2 vulnerabilities

It was discovered that libssh2 did not properly initialize publickey list entries before parsing. A remote attacker controlling a malicious SSH server could use this issue to cause a denial of service or possibly execute arbitrary code.

It was discovered that libssh2 incorrectly handled certain SFTP server responses. A remote attacker controlling an SSH server could use this issue to cause libssh2 to crash or possibly execute arbitrary code.

It was discovered that libssh2 did not properly check bounds in certain publickey subsystem responses. A remote attacker controlling a malicious SSH server could use this issue to cause a denial of service or possibly execute arbitrary code.

GLib vulnerabilities

It was discovered that GLib’s GDBus authentication mechanism failed to enforce length limitations on data lines read from a client. An unauthenticated attacker could exploit this to cause a denial of service via resource exhaustion.

It was discovered that the xdgmime library in GLib had a heap-based buffer overflow. An attacker-controlled MIME magic file could cause an out-of-bounds write on little-endian systems.

It was discovered that GLib had an off-by-one error in the GVariant serialiser. An attacker could use this to cause an out-of-bounds read, leading to information disclosure or a denial of service.

It was discovered that GLib had an out-of-bounds read in GDateTime. An attacker could use this to corrupt date output and cause a denial of service.

It was discovered that GLib’s g_regex_replace() function had a buffer over-read when used with the G_REGEX_RAW flag. An attacker could use this to cause information disclosure or a denial of service.

It was discovered that GLib’s GIOChannel had a buffer over-read when using a custom line terminator. An attacker could use this to cause information disclosure or a denial of service.

It was discovered that GLib’s GKeyFile had an off-by-one error when loading a key file with an empty value. An attacker could use this to cause an out-of-bounds access or a denial of service.

It was discovered that GLib’s DBUS_COOKIE_SHA1 authentication mechanism failed to validate the cookie_context parameter. A malicious D-Bus server could use this to read arbitrary files from the client.

It was discovered that GLib’s D-Bus introspection XML parser had a state confusion issue. An attacker could use this to cause an out-of-bounds read and denial of service.

Expat vulnerabilities

It was discovered that Expat could be made to allocate large amounts of memory when parsing a small crafted document. An attacker could possibly use this issue to cause Expat to consume resources, leading to a denial of service. This issue was only addressed in Qlustar 14.

It was discovered that Expat incorrectly handled empty external parameter entity content. An attacker could possibly use this issue to cause Expat to crash, resulting in a denial of service.

It was discovered that Expat incorrectly handled certain DTD content. An attacker could possibly use this issue to cause Expat to enter an infinite loop, resulting in a denial of service.

It was discovered that Expat incorrectly handled memory when retrying after an earlier out-of-memory condition. An attacker could possibly use this issue to cause Expat to crash, resulting in a denial of service.

It was discovered that Expat performed attribute name collision checks inefficiently. An attacker could possibly use this issue to cause Expat to consume resources when processing a moderately sized crafted XML document, resulting in a denial of service. This issue was only addressed in Qlustar 14.

It was discovered that Expat used insufficient entropy, allowing hash flooding through a crafted XML document. An attacker could possibly use this issue to cause Expat to consume resources, leading to a denial of service. This issue was only addressed in Qlustar 14.

It was discovered that Expat did not track handler call depth for certain functions called from within handlers, leading to a use-after-free. An attacker could possibly use this issue to cause Expat to crash, resulting in a denial of service, or possibly execute arbitrary code.

It was discovered that Expat incorrectly handled certain values, leading to integer overflows. An attacker could possibly use this issue to cause Expat to crash, resulting in a denial of service.

It was discovered that Expat incorrectly handled certain values, leading to an integer overflow. An attacker could possibly use this issue to cause Expat to crash, resulting in a denial of service.

libxml2 vulnerabilities

It was discovered that libxml2 incorrectly handled certain XML elements under certain circumstances. An attacker could possibly use this issue to cause libxml2 to crash or execute arbitrary code.

It was discovered that libxml2 incorrectly handled certain XML documents when used with Python bindings. A remote attacker could possibly use this issue to cause applications using libxml2 to crash, resulting in a denial of service.

rsyslog vulnerability

It was discovered that rsyslog incorrectly calculated buffer sizes when replacing strings. A remote attacker could possibly use this issue to cause rsyslog to crash, resulting in a denial of service.

AlmaLinux 8.10 security updates

Please check the AlmaLinux Errata site for details about AlmaLinux 8 updates that entered this release (everything from September 14th until September 24th).

Update instructions:

The problem can be corrected by updating your system to the following or more recent package versions:

For Qlustar 14

qlustar-module-core-noble-amd64-14.1       14.1.13-b589f1655
qlustar-module-core-centos8-amd64-14.1     14.1.13-b589f1655

For Qlustar 13

qlustar-module-core-jammy-amd64-13.4       13.4.12-b588f1653

Special Update instructions:

In addition to the steps described in the general Qlustar Update Instructions these updates require the following:

• Spack migration With the release of the HPC Core Stack 02/26, spack was also updated to version 1.1.1. If you haven’t yet migrated your spack database to version 8, login on a cluster node as a user with Spack admin rights (usually user softadm or anybody in the group softadm) and execute

  # spack reindex
  

  Note that after this, older Spack versions will no longer be able to read the database. However, a backup is created in case a revert is needed.

• Please note that we no longer provide 13.x AlmaLinux 8 modules for Qlustar 13. If you want to use AlmaLinux 8 under Qlustar 13, please switch to the 14.x image modules and create a corresponding chroot for it.