SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade slurm-wlm | Jan 19, 2022 | May 13, 2021 |
| Suse | — | Upgrade slurm-openlavaUpgrade slurm_20_02-sqlUpgrade libnss_slurm2Upgrade slurm_18_08-nodeUpgrade slurm-slurmdb-directUpgrade slurm_20_11-sviewUpgrade slurm_20_02-luaUpgrade slurm_20_02-config-manUpgrade libpmi0Upgrade slurm_20_02-configUpgrade slurm_20_02-docUpgrade slurm_18_08-luaUpgrade slurm-webdocUpgrade slurm_20_11Upgrade slurm_20_02-pam_slurmUpgrade slurm_20_02-mungeUpgrade slurm_18_08-configUpgrade libpmi0_18_08Upgrade slurm_18_08-auth-noneUpgrade slurm_20_02Upgrade libpmi0_20_02Upgrade slurm-auth-noneUpgrade slurm_20_02-auth-noneUpgrade slurm_20_11-nodeUpgrade slurm_20_02-develUpgrade libslurm33Upgrade slurmUpgrade slurm_20_11-webdocUpgrade libslurm36Upgrade slurm_18_08-docUpgrade slurm_20_11-auth-noneUpgrade slurm-torqueUpgrade slurm_18_08-pluginsUpgrade slurm-mungeUpgrade slurm_20_11-mungeUpgrade slurm_18_08-pam_slurmUpgrade slurm_20_11-torqueUpgrade slurm-sjstatUpgrade slurm_20_02-torqueUpgrade slurm-develUpgrade slurm-docUpgrade libnss_slurm2_20_11Upgrade slurm_18_08-sqlUpgrade slurm-config-manUpgrade slurm_20_02-slurmdbdUpgrade perl-slurmUpgrade slurm_20_11-sqlUpgrade slurm-slurmdbdUpgrade slurm-pam_slurmUpgrade slurm_18_08-develUpgrade slurm-restUpgrade libnss_slurm2_20_02Upgrade slurm_18_08-slurmdbdUpgrade slurm-sched-wikiUpgrade slurm-configUpgrade libpmi0_20_11Upgrade perl-slurm_18_08Upgrade slurm_20_02-sviewUpgrade slurm-seffUpgrade slurm_20_11-configUpgrade slurm_20_02-pluginsUpgrade slurm_20_11-slurmdbdUpgrade slurm_18_08-torqueUpgrade slurm_20_11-pluginsUpgrade slurm_18_08Upgrade slurm-crayUpgrade perl-slurm_20_02Upgrade slurm-sviewUpgrade libslurm31Upgrade libslurm35Upgrade slurm_20_02-nodeUpgrade slurm_20_11-develUpgrade slurm_18_08-mungeUpgrade slurm_20_11-pam_slurmUpgrade slurm-pluginsUpgrade slurm-sqlUpgrade slurm_20_11-luaUpgrade slurm_20_11-docUpgrade perl-slurm_20_11Upgrade slurm-luaUpgrade slurm-hdf5Upgrade slurm-nodeUpgrade slurm_20_11-config-man | Jun 1, 2021 | May 13, 2021 |
| Ubuntu | — | Upgrade slurm-client (Ubuntu Pro)Upgrade libslurmdb29 (Ubuntu Pro)Upgrade libslurm32 (Ubuntu Pro)Upgrade slurm-wlm-basic-plugins (Ubuntu Pro)Upgrade libslurmdb32 (Ubuntu Pro)Upgrade slurm-wlm-emulator (Ubuntu Pro)Upgrade slurmctld (Ubuntu Pro)Upgrade libslurm29 (Ubuntu Pro)Upgrade slurmd (Ubuntu Pro)Upgrade libslurm34 (Ubuntu Pro)Upgrade slurm-llnl (Ubuntu Pro)Upgrade slurmdbd (Ubuntu Pro)Upgrade slurm-client-emulator (Ubuntu Pro)Upgrade sview (Ubuntu Pro)Upgrade libslurmdb26 (Ubuntu Pro)Upgrade libslurm26 (Ubuntu Pro) | Mar 22, 2023 | May 13, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub