Slurm 19.05.x before 19.05.7 and 20.02.x before 20.02.3, in the rare case where Message Aggregation is enabled, allows Authentication Bypass via an Alternate Path or Channel. A race condition allows a user to launch a process as an arbitrary user.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade slurm-llnlUpgrade slurm-wlm | Jan 29, 2021 | May 21, 2020 |
| Suse | — | Upgrade slurm_20_11-webdocUpgrade libslurm35Upgrade pdsh-netgroupUpgrade libpmi0_20_02Upgrade slurm_20_11Upgrade slurm-docUpgrade slurm_18_08-luaUpgrade slurm_20_11-mungeUpgrade slurm-auth-noneUpgrade slurm-webdocUpgrade pdshUpgrade slurm_20_11-pluginsUpgrade slurm_20_02-mungeUpgrade slurm-openlavaUpgrade pdsh-slurm_20_02Upgrade slurm_20_11-sviewUpgrade slurm_20_02-torqueUpgrade slurm-configUpgrade slurm_18_08-sqlUpgrade pdsh-machinesUpgrade slurm_20_02-luaUpgrade slurm-nodeUpgrade slurm_18_08-develUpgrade slurm-luaUpgrade slurm_20_11-pam_slurmUpgrade slurm_18_08-torqueUpgrade slurm_20_02-pam_slurmUpgrade slurm_18_08-docUpgrade libslurm31Upgrade slurm_18_08Upgrade slurm-pam_slurmUpgrade slurm-seffUpgrade slurm-torqueUpgrade slurm_20_11-config-manUpgrade slurm-sviewUpgrade slurm-develUpgrade slurm_20_11-nodeUpgrade slurm_20_02-sviewUpgrade slurm-slurmdb-directUpgrade pdsh-slurmUpgrade slurm_20_11-slurmdbdUpgrade pdsh-gendersUpgrade slurm_20_02-docUpgrade pdsh-slurm_20_11Upgrade slurm_20_02-pluginsUpgrade slurm_18_08-pluginsUpgrade slurm-crayUpgrade slurm_20_02-config-manUpgrade perl-slurm_20_11Upgrade libpmi0_20_11Upgrade slurm-slurmdbdUpgrade slurm-hdf5Upgrade slurmUpgrade slurm-sjstatUpgrade libpmi0_18_08Upgrade perl-slurm_20_02Upgrade libslurm33Upgrade slurm_18_08-pam_slurmUpgrade slurm_20_11-torqueUpgrade slurm_20_11-sqlUpgrade slurm_20_02-develUpgrade slurm_18_08-auth-noneUpgrade slurm_20_11-luaUpgrade slurm_20_11-develUpgrade perl-slurm_18_08Upgrade libnss_slurm2_20_02Upgrade slurm-pluginsUpgrade slurm_18_08-configUpgrade slurm_20_11-auth-noneUpgrade slurm_20_02-nodeUpgrade slurm-config-manUpgrade slurm-sched-wikiUpgrade slurm_18_08-mungeUpgrade pdsh-slurm_18_08Upgrade slurm_20_02Upgrade pdsh-dshgroupUpgrade libslurm36Upgrade slurm_18_08-nodeUpgrade slurm_20_02-auth-noneUpgrade slurm_20_02-configUpgrade slurm_18_08-slurmdbdUpgrade slurm-sqlUpgrade libpmi0Upgrade slurm-mungeUpgrade slurm_20_02-slurmdbdUpgrade libnss_slurm2_20_11Upgrade slurm_20_11-docUpgrade perl-slurmUpgrade slurm_20_11-configUpgrade slurm_20_02-sql | Sep 15, 2020 | May 21, 2020 |
| Ubuntu | — | Upgrade libslurm32 (Ubuntu Pro)Upgrade slurm-client (Ubuntu Pro)Upgrade libslurm29 (Ubuntu Pro)Upgrade slurmd (Ubuntu Pro)Upgrade libslurmdb26 (Ubuntu Pro)Upgrade slurm-wlm-basic-plugins (Ubuntu Pro)Upgrade libslurm34 (Ubuntu Pro)Upgrade sview (Ubuntu Pro)Upgrade slurm-llnl (Ubuntu Pro)Upgrade libslurmdb29 (Ubuntu Pro)Upgrade slurm-wlm-emulator (Ubuntu Pro)Upgrade slurm-client-emulator (Ubuntu Pro)Upgrade libslurmdb32 (Ubuntu Pro)Upgrade slurmdbd (Ubuntu Pro)Upgrade slurmctld (Ubuntu Pro)Upgrade libslurm26 (Ubuntu Pro) | Mar 22, 2023 | May 21, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub