SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges and code execution.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges     and code execution. (CVE-2022-29501)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-417587a4b9 advisory.

    Automatic update for slurm-21.08.8-1.fc37.

    ##### **Changelog**

    ```
    * Thu May  5 2022 Carl George <carl@george.computer> - 21.08.8-1
    - Update to 21.08.8, resolves: rhbz#2082276
    - Fix CVE-2022-29500, resolves: rhbz#2082286
    - Fix CVE-2022-29501, resolves: rhbz#2082289
    - Fix CVE-2022-29502, resolves: rhbz#2082293

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-6a9dc1d46b advisory.

    Automatic update for slurm-22.05.6-1.fc38.

    ##### **Changelog**

    ```
    * Sun Nov 27 2022 Philip Kovacs <pkfed@fedoraproject.org> - 22.05.6-1
    - Update to 22.05.6 (#2131112)
    - Update deprecated vars in slurm.conf (#2133159)
    * Tue Sep  6 2022 Philip Kovacs <pkfed@fedoraproject.org> - 22.05.3-2
    - Add slurm to epel9 (#2072632); update spec for epel 7/8/9
    - Use * Mon Nov 28 2022 Fedora Project - 22.05.6-1.fc38
    - local build macro; add changelog file
    * Mon Sep  5 2022 Philip Kovacs <pkfed@fedoraproject.org> - 22.05.3-1
    - Update to 22.05.3
    - Thanks Cristian Le (fedora@lecris.me) for his contributions
    * Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 21.08.8-4
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
    * Mon May 30 2022 Jitka Plesnikova <jplesnik@redhat.com> - 21.08.8-3
    - Perl 5.36 rebuild
    * Mon May  9 2022 Philip Kovacs <pkfed@fedoraproject.org> - 21.08.8-2
    - Update to 21.08.8-2 (upstream re-release)
    * Thu May  5 2022 Carl George <carl@george.computer> - 21.08.8-1
    - Update to 21.08.8, resolves: rhbz#2082276
    - Fix CVE-2022-29500, resolves: rhbz#2082286
    - Fix CVE-2022-29501, resolves: rhbz#2082289
    - Fix CVE-2022-29502, resolves: rhbz#2082293
    * Sat Apr  2 2022 Philip Kovacs <pkfed@fedoraproject.org> - 21.08.6-1
    - Update to 21.08.6
    * Sat Jan 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 21.08.5-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
    * Fri Jan 14 2022 Philip Kovacs <pkfed@fedoraproject.org> - 21.08.5-1
    - Update to 21.08.5
    * Sun Nov 21 2021 Orion Poplawski <orion@nwra.com> - 21.08.4-2
    - Rebuild for hdf5 1.12.1
    * Wed Nov 17 2021 Philip Kovacs <pkfed@fedoraproject.org> - 21.08.4-1
    - Update to 21.08.4
    - Closes security issue CVE-2021-43337
    * Sun Oct 31 2021 Philip Kovacs <pkfed@fedoraproject.org> - 21.08.2-2
    - Correct log rotation problems (#2016683, #2018508)
    * Fri Oct  8 2021 Philip Kovacs <pkfed@fedoraproject.org> - 21.08.2-1
    - Update to 21.08.2
    - Added Fedora patches to support pmix v4
    - Remove slurm-pmi(-devel) subpackages
    * Tue Aug 10 2021 Orion Poplawski <orion@nwra.com> - 20.11.8-4
    - Rebuild for hdf5 1.10.7
    * Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 20.11.8-3
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
    * Sat Jul 10 2021 Bjrn Esser <besser82@fedoraproject.org> - 20.11.8-2
    - Rebuild for versioned symbols in json-c
    * Sat Jul  3 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.8-1
    - Update to 20.11.8
    * Tue May 25 2021 Jitka Plesnikova <jplesnik@redhat.com> - 20.11.7-4
    - Perl 5.34 re-rebuild updated packages
    * Mon May 24 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.7-3
    - Move auth_jwt.so plugin to base package (#1947878)
    * Fri May 21 2021 Jitka Plesnikova <jplesnik@redhat.com> - 20.11.7-2
    - Perl 5.34 rebuild
    * Sat May 15 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.7-1
    - Update to 20.11.7
    - Closes security issue CVE-2021-31215
    * Tue May  4 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.6-1
    - Release of 20.11.6
    * Mon Apr 12 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.5-2
    - Add subpackage slurm-slurmrestd (Slurm REST API daemon)
    * Fri Mar 26 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.5-1
    - Release of 20.11.5
    * Tue Mar  2 2021 Zbigniew Jdrzejewski-Szmek <zbyszek@in.waw.pl> - 20.11.3-3
    - Rebuilt for updated systemd-rpm-macros       See https://pagure.io/fesco/issue/2583.
    * Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 20.11.3-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
    * Tue Jan 19 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.3-1
    - Release of 20.11.3
    * Wed Jan  6 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.2-2
    - Minor spec adjustments
    * Tue Jan  5 2021 Philip Kovacs <pkfed@fedoraproject.org> - 20.11.2-1
    - Release of 20.11.2

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 ESM / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6458-1 advisory.

    It was discovered that Slurm did not properly handle credential management, which could allow an     unprivileged user to impersonate the SlurmUser account. An attacker could possibly use this issue to     execute arbitrary code as the root user. (CVE-2022-29500)

    It was discovered that Slurm did not properly handle access control when dealing with RPC traffic through     PMI2 and PMIx, which could allow an unprivileged user to send data to an arbitrary unix socket in the     host. An attacker could possibly use this issue to execute arbitrary code as the root user.
    (CVE-2022-29501)

    It was discovered that Slurm did not properly handle validation logic when processing input and output     data with the srun client, which could lead to the interception of process I/O. An attacker could possibly     use this issue to expose sensitive information or execute arbitrary code. This issue only affected Ubuntu     22.04 LTS. (CVE-2022-29502)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3535-1 advisory.

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.
    (CVE-2022-29500)

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges     and code execution. (CVE-2022-29501)

  - A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory     allows local attackers with control over the slurm user to escalate to root. This issue affects: openSUSE     Factory slurm versions prior to 22.05.2-3.3. (CVE-2022-31251)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3497-1 advisory.

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.
    (CVE-2022-29500)

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges     and code execution. (CVE-2022-29501)

  - A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory     allows local attackers with control over the slurm user to escalate to root. This issue affects: openSUSE     Factory slurm versions prior to 22.05.2-3.3. (CVE-2022-31251)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3490-1 advisory.

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.
    (CVE-2022-29500)

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges     and code execution. (CVE-2022-29501)

  - A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory     allows local attackers with control over the slurm user to escalate to root. This issue affects: openSUSE     Factory slurm versions prior to 22.05.2-3.3. (CVE-2022-31251)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3491-1 advisory.

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.
    (CVE-2022-29500)

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges     and code execution. (CVE-2022-29501)

  - A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory     allows local attackers with control over the slurm user to escalate to root. This issue affects: openSUSE     Factory slurm versions prior to 22.05.2-3.3. (CVE-2022-31251)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3477-1 advisory.

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.
    (CVE-2022-29500)

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges     and code execution. (CVE-2022-29501)

  - A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory     allows local attackers with control over the slurm user to escalate to root. This issue affects: openSUSE     Factory slurm versions prior to 22.05.2-3.3. (CVE-2022-31251)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3462-1 advisory.

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.
    (CVE-2022-29500)

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges     and code execution. (CVE-2022-29501)

  - A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory     allows local attackers with control over the slurm user to escalate to root. This issue affects: openSUSE     Factory slurm versions prior to 22.05.2-3.3. (CVE-2022-31251)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3468-1 advisory.

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.
    (CVE-2022-29500)

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges     and code execution. (CVE-2022-29501)

  - A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory     allows local attackers with control over the slurm user to escalate to root. This issue affects: openSUSE     Factory slurm versions prior to 22.05.2-3.3. (CVE-2022-31251)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3454-1 advisory.

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.
    (CVE-2022-29500)

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges     and code execution. (CVE-2022-29501)

  - A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory     allows local attackers with control over the slurm user to escalate to root. This issue affects: openSUSE     Factory slurm versions prior to 22.05.2-3.3. (CVE-2022-31251)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5166 advisory.

    Two security issues were discovered in the Simple Linux Utility for Resource Management (SLURM), a cluster     resource management and job scheduling system, which could result in privilege escalation. For the stable     distribution (bullseye), these problems have been fixed in version 20.11.7+really20.11.4-2+deb11u1. We     recommend that you upgrade your slurm-wlm packages. For the detailed security status of slurm-wlm please     refer to its security tracker page at: https://security-tracker.debian.org/tracker/slurm-wlm

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1831-1 advisory.

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.
    (CVE-2022-29500)

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges     and code execution. (CVE-2022-29501)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1815-1 advisory.

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.
    (CVE-2022-29500)

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges     and code execution. (CVE-2022-29501)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1726-1 advisory.

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.
    (CVE-2022-29500)

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges     and code execution. (CVE-2022-29501)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1666-1 advisory.

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.
    (CVE-2022-29500)

  - SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges     and code execution. (CVE-2022-29501)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
256845	Linux Distros Unpatched Vulnerability : CVE-2022-29501	Nessus	Misc.	high
211435	Fedora 37 : slurm (2022-417587a4b9)	Nessus	Fedora Local Security Checks	critical
211087	Fedora 38 : slurm (2022-6a9dc1d46b)	Nessus	Fedora Local Security Checks	critical
184019	Ubuntu 20.04 ESM / 22.04 ESM : Slurm vulnerabilities (USN-6458-1)	Nessus	Ubuntu Local Security Checks	critical
165752	SUSE SLES15 Security Update : slurm (SUSE-SU-2022:3535-1)	Nessus	SuSE Local Security Checks	high
165671	SUSE SLES12 Security Update : slurm (SUSE-SU-2022:3497-1)	Nessus	SuSE Local Security Checks	high
165664	SUSE SLES15 Security Update : slurm (SUSE-SU-2022:3490-1)	Nessus	SuSE Local Security Checks	high
165648	SUSE SLES15 Security Update : slurm_20_02 (SUSE-SU-2022:3491-1)	Nessus	SuSE Local Security Checks	high
165614	SUSE SLES12 Security Update : slurm_20_02 (SUSE-SU-2022:3477-1)	Nessus	SuSE Local Security Checks	high
165580	SUSE SLES15 Security Update : slurm_18_08 (SUSE-SU-2022:3462-1)	Nessus	SuSE Local Security Checks	high
165578	SUSE SLES15 Security Update : slurm (SUSE-SU-2022:3468-1)	Nessus	SuSE Local Security Checks	high
165573	SUSE SLES12 Security Update : slurm_18_08 (SUSE-SU-2022:3454-1)	Nessus	SuSE Local Security Checks	high
162415	Debian DSA-5166-1 : slurm-wlm - security update	Nessus	Debian Local Security Checks	high
161496	SUSE SLES15 Security Update : slurm_20_11 (SUSE-SU-2022:1831-1)	Nessus	SuSE Local Security Checks	high
161465	SUSE SLES15 Security Update : slurm_20_11 (SUSE-SU-2022:1815-1)	Nessus	SuSE Local Security Checks	high
161360	SUSE SLES12 Security Update : slurm_20_11 (SUSE-SU-2022:1726-1)	Nessus	SuSE Local Security Checks	high
161222	SUSE SLES15 Security Update : slurm (SUSE-SU-2022:1666-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2022-29501

high

Tenable Plugins

high

critical

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high