[QSA-1016262]
Security Update Bundle

Qlustar Security Advisory 1016262

October 16th, 2026

Summary:

A Qlustar security update bundle is a cumulative update of packages that are taken from upstream Debian/Ubuntu without modification. Only packages that are used in a typical HPC/Storage cluster installation are mentioned in Qlustar Security Advisories. Other non-HPC related updates also enter the Qlustar repository, but their functionality is not separately verified by the Qlustar team. To track these updates subscribe to the general security mailing lists of Debian/Ubuntu and/or AlmaLinux.

Package(s)       : see upstream description of individual package
Qlustar releases : 13, 14
Affected versions: All versions prior to this update
Vulnerability    : see upstream description of individual package
Problem type     : see upstream description of individual package
Qlustar-specific : no
CVE Id(s)        : see upstream description of individual package

This update includes several security related package updates from Debian/Ubuntu and AlmaLinux. The following list provides references to the upstream security report of the corresponding packages. You can view the original upstream advisory by clicking on the corresponding title.

Relevant to Qlustar 13 and/or 14 – Ubuntu

If an advisory applies only to Qlustar 13 or 14, it is noted in its description.

curl vulnerabilities

Stanislav Fort discovered that curl did not properly clear AWS SigV4 authentication state when CURLOPT_AWS_SIGV4 was set to NULL. An attacker could possibly use this issue to obtain sensitive information.

Stanislav Fort discovered that an HTTP proxy could trick libcurl into sending credentials to the proxy itself by responding to a CONNECT request with an unexpected authentication challenge. An attacker could possibly use this issue to obtain sensitive information.

Stanislav Fort discovered that curl did not correctly handle HSTS entries when an includeSubDomains parent entry was imported before a longer-lived child entry. An attacker could possibly use this issue to cause curl to use unencrypted HTTP connections.

Stanislav Fort discovered that curl did not properly handle HSTS max-age values that exceeded calendar time structure bounds. An attacker could possibly use this issue to cause a denial of service or data loss. This issue only affected Qlustar 14.

Stanislav Fort discovered that curl did not properly handle IMAP APPEND commands when CURLOPT_CRLF was enabled, allowing overflow bytes to be interpreted as pipelined commands. An authenticated attacker could possibly use this issue to inject arbitrary IMAP commands.

Joshua Rogers discovered that libcurl had a use-after-free vulnerability in the FTP wildcard matching code. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code.

Joshua Rogers discovered that libcurl’s TFTP state machine did not properly validate transfer directions, allowing a malicious server to force the client into transmit mode. An attacker could possibly use this issue to obtain sensitive information.

Joshua Rogers discovered that curl had a stack overflow vulnerability when processing deeply nested MIME structures. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service.

Joshua Rogers discovered that libcurl could expose credentials in the URL returned by CURLINFO_EFFECTIVE_URL when credentials were retrieved from a .netrc file. An attacker could possibly use this issue to obtain sensitive information.

OpenSSH vulnerabilities

It was discovered that OpenSSH’s sftp client incorrectly handled paths returned by the server during a recursive copy operation. A remote attacker controlling the server could possibly use this issue to write files to unintended locations.

It was discovered that OpenSSH’s sshd server incorrectly handled GSSAPIAuthentication state across authentication attempts. An attacker could possibly use this issue to obtain credentials from a previous failed authentication attempt.

It was discovered that OpenSSH incorrectly used an LZ77 dictionary coder during compression. An attacker could possibly use this issue to obtain sensitive information.

It was discovered that OpenSSH’s ssh client incorrectly allowed special characters in command-line usernames. An attacker could possibly use this issue to inject arbitrary commands via specially crafted usernames.

It was discovered that OpenSSH’s ssh-keygen incorrectly handled Daylight Saving Time when converting dates. An attacker could possibly use this issue to cause certificates to have incorrect expiration times.

It was discovered that OpenSSH did not check whether the maximum packet length was exceeded during decompression. A remote attacker could possibly use this issue to cause a denial of service.

It was discovered that OpenSSH’s sshd server incorrectly applied the restrict keyword from authorized_keys to tunnel forwarding requests. A local attacker with an authorized key could possibly use this issue to bypass intended tunnel forwarding restrictions.

It was discovered that OpenSSH’s sshd server incorrectly handled certain configuration options that accept a “none” value. An attacker could possibly use this issue to cause OpenSSH to behave unexpectedly.

libx11 vulnerabilities

Adam Bedard discovered that libx11 incorrectly handled certain XKB keyboard map replies. If a user were tricked into connecting to a malicious X server, a remote attacker could possibly use this issue to cause libx11 to crash, resulting in a denial of service, or possibly execute arbitrary code.

It was discovered that libx11 incorrectly handled certain X Input Method (XIM) messages. If a user were tricked into connecting to a malicious X server, a remote attacker could possibly use these issues to cause libx11 to crash, resulting in a denial of service.

It was discovered that libx11 incorrectly handled converting certain multibyte text. An attacker could possibly use this issue to cause libx11 to crash, resulting in a denial of service.

libxml2 vulnerabilities

Yirou Yang discovered that libxml2 incorrectly handled certain XML catalogs. If a user or automated system was tricked into processing a specially crafted XML catalog, an attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service.

It was discovered that libxml2 incorrectly handled certain large qualified names, leading to a heap-based buffer overflow. An attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code.

Xudong Cao and Meng Xu discovered that libxml2 incorrectly handled certain large XPointer expressions, leading to a heap-based buffer overflow. An attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute arbitrary code.

Xudong Cao and Meng Xu discovered that libxml2 did not check for integer overflows before passing output lengths to write callbacks. An attacker could possibly use this issue to cause an application using libxml2 to crash, resulting in a denial of service.

It was discovered that libxml2 did not apply parser options, such as disabling network access, when processing XInclude directives under certain circumstances. An attacker could possibly use this issue to perform XML external entity injection or server-side request forgery attacks, or cause a denial of service.

libpng vulnerability

Ze Sheng discovered that libpng incorrectly handled certain compressed data chunks in PNG files. An attacker could possibly use this issue to cause a denial of service.

Apache HTTP Server vulnerabilities

It was discovered that Apache HTTP Server’s mod_rewrite module incorrectly handled memory when performing certain variable lookups. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

Lucian Nitescu, Simon Kappel, and Gianluca Danesin discovered that Apache HTTP Server’s mod_http2 module incorrectly handled memory when processing certain HTTP/2 connections. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code.

Juthawong Naisanguansee, Charles Vosburgh, Mike Read, and Ryoma Nishioka discovered that Apache HTTP Server’s mod_ssl module incorrectly handled certain expressions. An attacker could possibly use this issue to bypass intended access restrictions.

libarchive vulnerability

It was discovered that libarchive had a signed integer overflow in its ZIP writer when handling encrypted entries with sizes near the maximum value. An attacker could possibly use this issue to cause libarchive to crash or execute arbitrary code.

Sudo vulnerability

It was discovered that Sudo did not properly handle time-based access restrictions when sudoers rules used NOTBEFORE or NOTAFTER with timestamps omitting the trailing timezone indicator. A local attacker could possibly use this issue to execute commands outside the intended time window by manipulating the TZ environment variable.

libsoup vulnerabilities

It was discovered that libsoup incorrectly handled certain HTTP/2 requests. A remote attacker could possibly use this issue to cause a denial of service.

It was discovered that libsoup incorrectly handled certain HTTPS proxy connections. A remote attacker could possibly use this issue to obtain sensitive information.

It was discovered that libsoup incorrectly parsed certain chunked HTTP requests. A remote attacker could possibly use this issue to bypass security controls.

It was discovered that libsoup incorrectly handled proxy authentication credentials. A remote attacker could possibly use this issue to obtain sensitive information.

It was discovered that libsoup incorrectly handled certain HTTP Range headers. A remote attacker could possibly use this issue to cause a denial of service.

It was discovered that libsoup incorrectly handled certain HTTP/2 connections. A remote attacker could possibly use this issue to obtain sensitive information or execute arbitrary code.

It was discovered that libsoup incorrectly handled certain HTTP/2 transfers. A remote attacker could possibly use this issue to cause a denial of service.

sg3_utils vulnerability

Shaomin Chen discovered that sg3_utils did not properly sanitize device identification data. An attacker could possibly use this issue to execute arbitrary commands.

AlmaLinux 8.10 security updates

Please check the AlmaLinux Errata site for details about AlmaLinux 8 updates that entered this release (everything from October 1st until October 16th).

Update instructions:

The problem can be corrected by updating your system to the following or more recent package versions:

For Qlustar 14

qlustar-module-core-noble-amd64-14.1       14.1.15-b589f1661
qlustar-module-core-centos8-amd64-14.1     14.1.15-b589f1661

For Qlustar 13

qlustar-module-core-jammy-amd64-13.4       13.4.14-b588f1660

Special Update instructions:

In addition to the steps described in the general Qlustar Update Instructions these updates require the following:

• Spack migration With the release of the HPC Core Stack 02/26, spack was also updated to version 1.1.1. If you haven’t yet migrated your spack database to version 8, login on a cluster node as a user with Spack admin rights (usually user softadm or anybody in the group softadm) and execute

  # spack reindex
  

  Note that after this, older Spack versions will no longer be able to read the database. However, a backup is created in case a revert is needed.

• Please note that we no longer provide 13.x AlmaLinux 8 modules for Qlustar 13. If you want to use AlmaLinux 8 under Qlustar 13, please switch to the 14.x image modules and create a corresponding chroot for it.