centos-sig-hyperscale / sig

#156 Import fixed pmix and rebuild dependents for CVE-2023-41915
Closed by salimma. Opened by salimma.

Closed
Reopen Issue

CVE notice: https://nvd.nist.gov/vuln/detail/CVE-2023-41915
Fedora bug: https://bugzilla.redhat.com/show_bug.cgi?id=2238861
RHEL/CS bug: https://issues.redhat.com/browse/RHEL-3664?filter=-2

Tracking details here since there's quite a few things involved
- the Rawhide packages all rebuild fine in COPR against pmix 4.1.3 (Fedora already had 4.1.2)
- slurm from EPEL 9 rebuilds fine against pmix 4.1.3 (as expected, it's the same as slurm in Fedora)
- openmpi from c9s appstream does not rebuild fine - and it has two epoch bumps

No other dependents of pmix in c9s -- will do c8s analysis and fix later. So the best plan now is to source openmpi from Fedora instead of from c9s and bump the epoch to preserve an upgrade path.

slurm repo request (done): https://pagure.io/centos-infra/issue/1274

hs.el9 Builds:
pmix-4.1.3-1.hs.el9 - https://cbs.centos.org/koji/buildinfo?buildID=50809
openmpi-2:4.1.4-1.1.hs.el9 - https://cbs.centos.org/koji/buildinfo?buildID=50810
slurm-22.05.9-1.1.hs.el9 - https://cbs.centos.org/koji/buildinfo?buildID=50811

built packages available in https://mirror.stream.centos.org/SIGs/9-stream/hyperscale/aarch64/packages-main/Packages/p/ (pmix), https://mirror.stream.centos.org/SIGs/9-stream/hyperscale/aarch64/packages-main/Packages/o/ (openmpi), and https://mirror.stream.centos.org/SIGs/9-stream/hyperscale/aarch64/packages-main/Packages/s/ (slurm)

hs.el8 builds:

https://cbs.centos.org/koji/buildinfo?buildID=50816
https://cbs.centos.org/koji/buildinfo?buildID=50817
https://cbs.centos.org/koji/buildinfo?buildID=50818

Metadata Update from @salimma:
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.