Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, allowing privilege escalation to root during Prolog or Epilog execution.
CVSS Details
- CVSS 3.0 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade slurm-llnl | Dec 5, 2017 | Nov 1, 2017 |
| Suse | — | Upgrade perl-slurm_20_02Upgrade slurm_20_11-develUpgrade slurm_18_08-pam_slurmUpgrade libslurm35Upgrade slurm_18_08Upgrade slurm-pluginsUpgrade slurm_20_02-sviewUpgrade slurm_20_02-slurmdbdUpgrade perl-slurmUpgrade slurm_20_11-configUpgrade pdsh-dshgroupUpgrade libnss_slurm2_20_11Upgrade libnss_slurm2_20_02Upgrade pdsh-netgroupUpgrade slurm_20_11-slurmdbdUpgrade slurm_20_11-docUpgrade slurm_18_08-mungeUpgrade pdshUpgrade slurm_18_08-slurmdbdUpgrade slurm_20_02-torqueUpgrade slurm-sqlUpgrade slurm_18_08-develUpgrade slurm_20_11-luaUpgrade slurm_18_08-pluginsUpgrade slurm_20_11-pluginsUpgrade slurm_18_08-torqueUpgrade libslurm29Upgrade slurm_20_02-nodeUpgrade slurm_20_11-pam_slurmUpgrade slurm_20_11-nodeUpgrade slurm-slurmdbdUpgrade slurm_20_11-config-manUpgrade slurm_20_02-pluginsUpgrade slurm_20_02-sqlUpgrade slurm_20_11-mungeUpgrade pdsh-slurm_20_02Upgrade slurm-mungeUpgrade slurm-auth-noneUpgrade perl-slurm_20_11Upgrade libpmi0_20_11Upgrade libslurm31Upgrade slurm-develUpgrade slurm_18_08-sqlUpgrade slurm_20_11-torqueUpgrade slurm-sched-wikiUpgrade slurm_20_11-sqlUpgrade pdsh-slurm_20_11Upgrade slurm-pam_slurmUpgrade libslurm33Upgrade slurm-luaUpgrade slurm_20_11-sviewUpgrade perl-slurm_18_08Upgrade slurm-docUpgrade slurm_20_02-develUpgrade slurm-slurmdb-directUpgrade slurm_20_02-configUpgrade slurm_18_08-configUpgrade pdsh-slurmUpgrade slurm_20_11-auth-noneUpgrade slurm_20_02-docUpgrade slurm-torqueUpgrade pdsh-gendersUpgrade pdsh-slurm_18_08Upgrade slurm_20_02-auth-noneUpgrade libpmi0_18_08Upgrade slurm_20_02-pam_slurmUpgrade libpmi0_20_02Upgrade slurm_20_02Upgrade slurmUpgrade slurm_18_08-luaUpgrade slurm_18_08-auth-noneUpgrade slurm_20_02-mungeUpgrade slurm_20_11Upgrade pdsh-machinesUpgrade slurm_18_08-docUpgrade libslurm36Upgrade slurm_20_02-config-manUpgrade slurm_18_08-nodeUpgrade slurm_20_11-webdocUpgrade slurm_20_02-luaUpgrade libpmi0 | Jun 9, 2021 | Nov 1, 2017 |
| Ubuntu | — | Upgrade slurmctld (Ubuntu Pro)Upgrade sview (Ubuntu Pro)Upgrade libslurm29 (Ubuntu Pro)Upgrade slurm-llnl (Ubuntu Pro)Upgrade libslurm26 (Ubuntu Pro)Upgrade slurm-client-emulator (Ubuntu Pro)Upgrade libslurmdb29 (Ubuntu Pro)Upgrade slurm-wlm-emulator (Ubuntu Pro)Upgrade slurmdbd (Ubuntu Pro)Upgrade libslurm34 (Ubuntu Pro)Upgrade slurm-wlm-basic-plugins (Ubuntu Pro)Upgrade slurm-client (Ubuntu Pro)Upgrade libslurmdb32 (Ubuntu Pro)Upgrade libslurmdb26 (Ubuntu Pro)Upgrade slurmd (Ubuntu Pro)Upgrade libslurm32 (Ubuntu Pro) | Mar 22, 2023 | Nov 1, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub