SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-6a9dc1d46b advisory.

    Automatic update for slurm-22.05.6-1.fc38.

    ##### **Changelog**

    ```
    * Sun Nov 27 2022 Philip Kovacs <pkfed@fedoraproject.org> - 22.05.6-1
    - Update to 22.05.6 (#2131112)
    - Update deprecated vars in slurm.conf (#2133159)
    * Tue Sep  6 2022 Philip Kovacs <pkfed@fedoraproject.org> - 22.05.3-2
    - Add slurm to epel9 (#2072632); update spec for epel 7/8/9
    - Use * Mon Nov 28 2022 Fedora Project - 22.05.6-1.fc38
    - local build macro; add changelog file
    * Mon Sep  5 2022 Philip Kovacs <pkfed@fedoraproject.org> - 22.05.3-1
    - Update to 22.05.3
    - Thanks Cristian Le (fedora@lecris.me) for his contributions
    * Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 21.08.8-4
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
    * Mon May 30 2022 Jitka Plesnikova <jplesnik@redhat.com> - 21.08.8-3
    - Perl 5.36 rebuild
    * Mon May  9 2022 Philip Kovacs <pkfed@fedoraproject.org> - 21.08.8-2
    - Update to 21.08.8-2 (upstream re-release)
    * Thu May  5 2022 Carl George <carl@george.computer> - 21.08.8-1
    - Update to 21.08.8, resolves: rhbz#2082276
    - Fix CVE-2022-29500, resolves: rhbz#2082286
    - Fix CVE-2022-29501, resolves: rhbz#2082289
    - Fix CVE-2022-29502, resolves: rhbz#2082293
    * Sat Apr  2 2022 Philip Kovacs <pkfed@fedoraproject.org> - 21.08.6-1
    - Update to 21.08.6
    * Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 21.08.5-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
    * Fri Jan 14 2022 Philip Kovacs <pkfed@fedoraproject.org> - 21.08.5-1
    - Update to 21.08.5
    * Sun Nov 21 2021 Orion Poplawski <orion@nwra.com> - 21.08.4-2
    - Rebuild for hdf5 1.12.1
    * Wed Nov 17 2021 Philip Kovacs <pkfed@fedoraproject.org> - 21.08.4-1
    - Update to 21.08.4
    - Closes security issue CVE-2021-43337
    * Sun Oct 31 2021 Philip Kovacs <pkfed@fedoraproject.org> - 21.08.2-2
    - Correct log rotation problems (#2016683, #2018508)
    * Fri Oct  8 2021 Philip Kovacs <pkfed@fedoraproject.org> - 21.08.2-1
    - Update to 21.08.2
    - Added Fedora patches to support pmix v4
    - Remove slurm-pmi(-devel) subpackages
    * Tue Aug 10 2021 Orion Poplawski <orion@nwra.com> - 20.11.8-4
    - Rebuild for hdf5 1.10.7
    * Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 20.11.8-3
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
    * Sat Jul 10 2021 Bjrn Esser <besser82@fedoraproject.org> - 20.11.8-2
    - Rebuild for versioned symbols in json-c
    * Sat Jul  3 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.8-1
    - Update to 20.11.8
    * Tue May 25 2021 Jitka Plesnikova <jplesnik@redhat.com> - 20.11.7-4
    - Perl 5.34 re-rebuild updated packages
    * Mon May 24 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.7-3
    - Move auth_jwt.so plugin to base package (#1947878)
    * Fri May 21 2021 Jitka Plesnikova <jplesnik@redhat.com> - 20.11.7-2
    - Perl 5.34 rebuild
    * Sat May 15 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.7-1
    - Update to 20.11.7
    - Closes security issue CVE-2021-31215
    * Tue May  4 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.6-1
    - Release of 20.11.6
    * Mon Apr 12 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.5-2
    - Add subpackage slurm-slurmrestd (Slurm REST API daemon)
    * Fri Mar 26 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.5-1
    - Release of 20.11.5
    * Tue Mar  2 2021 Zbigniew Jdrzejewski-Szmek <zbyszek@in.waw.pl> - 20.11.3-3
    - Rebuilt for updated systemd-rpm-macros       See https://pagure.io/fesco/issue/2583.
    * Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 20.11.3-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
    * Tue Jan 19 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.3-1
    - Release of 20.11.3
    * Wed Jan  6 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.2-2
    - Minor spec adjustments
    * Tue Jan  5 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.2-1
    - Release of 20.11.2

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4781-1 advisory.

    It was discovered that Slurm incorrectly handled certain messages between the daemon and the user. An     attacker could possibly use this issue to assume control of an arbitrary file on the system. This issue     only affected Ubuntu 16.04 ESM. (CVE-2016-10030)

    It was discovered that Slurm mishandled SPANK environment variables. An attacker could possibly use this     issue to gain elevated privileges. This issue only affected Ubuntu 16.04 ESM. (CVE-2017-15566)

    It was discovered that Slurm mishandled certain SQL queries. A local attacker could use this issue to gain     elevated privileges. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04 ESM.
    (CVE-2018-7033)

    It was discovered that Slurm mishandled user names and group ids. A local attacker could use this issue to     gain administrative privileges. This issue only affected Ubuntu 14.04 ESM and Ubuntu 18.04 ESM.
    (CVE-2018-10995)

    It was discovered that Slurm mishandled 23-bit systems. A local attacker could use this to gain     administrative privileges. This issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and Ubuntu 18.04     ESM. (CVE-2019-6438)

    It was discovered that Slurm incorrectly handled certain inputs when Message Aggregation is enabled. An     attacker could possibly use this issue to launch a process as an arbitrary user. This issue only affected     Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12693)

    It was discovered that Slurm incorrectly handled certain RPC inputs. An attacker could possibly use this     issue to execute arbitrary code. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.
    (CVE-2020-27745)

    Jonas Stare discovered that Slurm exposes sensitive information related to the X protocol. An attacker     could possibly use this issue to obtain a graphical session from an arbitrary user. This issue only     affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-27746)

    It was discovered that Slurm incorrectly handled environment parameters. An attacker could possibly use     this issue to execute arbitrary code. (CVE-2021-31215)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2886 advisory.

    Multiple security issues were discovered in the Simple Linux Utility for Resource Management (SLURM), a     cluster resource management and job scheduling system, which could result in denial of service,     information disclosure or privilege escalation. CVE-2019-12838 SchedMD Slurm allows SQL Injection.
    CVE-2020-12693 In the rare case where Message Aggregation is enabled, Slurm allows Authentication Bypass     via an Alternate Path or Channel. A race condition allows a user to launch a process as an arbitrary user.
    CVE-2020-27745 RPC Buffer Overflow in the PMIx MPI plugin. CVE-2021-31215 SchedMD Slurm allows remote code     execution as SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment     mishandling. For Debian 9 stretch, these problems have been fixed in version 16.05.9-1+deb9u5. We     recommend that you upgrade your slurm-llnl packages. For the detailed security status of slurm-llnl please     refer to its security tracker page at: https://security-tracker.debian.org/tracker/slurm-llnl Further     information about Debian LTS security advisories, how to apply these updates to your system and frequently     asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2021:2473-1 advisory.

  - SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as     SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling.
    (CVE-2021-31215)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2021:2295-1 advisory.

  - SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as     SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling.
    (CVE-2021-31215)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2021:1856-1 advisory.

  - SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as     SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling.
    (CVE-2021-31215)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2021:1855-1 advisory.

  - SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as     SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling.
    (CVE-2021-31215)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for slurm fixes the following issues :

  - CVE-2021-31215: Fixed a environment mishandling that     allowed remote code execution as SlurmUser     (bsc#1186024).

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for slurm_20_11 fixes the following issues :

Udpate to 20.02.7 :

CVE-2021-31215: remote code execution as SlurmUser because of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling (bsc#1186024)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for slurm fixes the following issues :

CVE-2021-31215: Fixed a environment mishandling that allowed remote code execution as SlurmUser (bsc#1186024).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for slurm_18_08 fixes the following issues :

CVE-2021-31215: remote code execution as SlurmUser because of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling (bsc#1186024)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for slurm fixes the following issues :

CVE-2021-31215: remote code execution as SlurmUser because of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling (bsc#1186024)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for slurm_20_11 fixes the following issues :

Udpate to 20.11.7 :

CVE-2021-31215: remote code execution as SlurmUser because of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling (bsc#1186024)

Ship REST API version and auth plugins with slurmrestd.

Add YAML support for REST API to build (bsc#1185603).

Fix Provides:/Conflicts: for libnss_slurm (bsc#1180700).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
211087	Fedora 38 : slurm (2022-6a9dc1d46b)	Nessus	Fedora Local Security Checks	critical
183132	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : Slurm vulnerabilities (USN-4781-1)	Nessus	Ubuntu Local Security Checks	critical
156773	Debian DLA-2886-1 : slurm-llnl - LTS security update	Nessus	Debian Local Security Checks	critical
152104	SUSE SLES15 Security Update : slurm (SUSE-SU-2021:2473-1)	Nessus	SuSE Local Security Checks	high
151530	SUSE SLES15 Security Update : slurm_20_11 (SUSE-SU-2021:2295-1)	Nessus	SuSE Local Security Checks	high
150698	SUSE SLES15 Security Update : slurm_18_08 (SUSE-SU-2021:1856-1)	Nessus	SuSE Local Security Checks	high
150686	SUSE SLES15 Security Update : slurm (SUSE-SU-2021:1855-1)	Nessus	SuSE Local Security Checks	high
150183	openSUSE Security Update : slurm (openSUSE-2021-821)	Nessus	SuSE Local Security Checks	high
150112	SUSE SLES12 Security Update : slurm_20_11 (SUSE-SU-2021:1789-1)	Nessus	SuSE Local Security Checks	high
150108	SUSE SLES15 Security Update : slurm (SUSE-SU-2021:1810-1)	Nessus	SuSE Local Security Checks	high
150092	SUSE SLES12 Security Update : slurm_18_08 (SUSE-SU-2021:1788-1)	Nessus	SuSE Local Security Checks	high
150085	SUSE SLES12 Security Update : slurm (SUSE-SU-2021:1787-1)	Nessus	SuSE Local Security Checks	high
150084	SUSE SLES12 Security Update : slurm_20_11 (SUSE-SU-2021:1791-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2021-31215

high

Tenable Plugins

critical

critical

critical

high

high

high

high

high

high

high

high

high

high