Open OnDemand Denial-of-Service Vulnerability via Log Flooding in Shell App

A denial-of-service vulnerability has been identified in Open OnDemand, an open-source HPC portal. Users can generate excessive errors in the shell application, leading to the creation of large log files. This log flooding causes a denial-of-service condition on the OnDemand system. The vulnerability affects Open OnDemand versions 1.6 and above, prior to 3.1.14 and 4.0.6.

Impact

Excessive log generation can create very large log files, causing a denial-of-service condition on the OnDemand system.

Remediation

Users can upgrade to Open OnDemand versions 3.1.14 or 4.0.6, where this vulnerability has been patched. Centers may also apply the patch manually by replicating the changes from the GitHub pull request #4461 to the file '/var/www/ood/apps/sys/shell/app.js'.