Schedmd: Security Vulnerabilities
SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges.
CVSS Score
9.8
EPSS Score
0.006
Published
2022-05-05
SchedMD Slurm 21.08.* before 21.08.4 has Incorrect Access Control. On sites using the new AccountingStoreFlags=job_script and/or job_env options, the access control rules in SlurmDBD may permit users to request job scripts and environment files to which they should not have access.
CVSS Score
6.5
EPSS Score
0.005
Published
2021-11-17
SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling.
CVSS Score
8.8
EPSS Score
0.007
Published
2021-05-13
Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem.
CVSS Score
3.7
EPSS Score
0.003
Published
2020-11-27
Slurm before 19.05.8 and 20.x before 20.02.6 has an RPC Buffer Overflow in the PMIx MPI plugin.
CVSS Score
9.8
EPSS Score
0.008
Published
2020-11-27
Slurm 19.05.x before 19.05.7 and 20.02.x before 20.02.3, in the rare case where Message Aggregation is enabled, allows Authentication Bypass via an Alternate Path or Channel. A race condition allows a user to launch a process as an arbitrary user.
CVSS Score
8.1
EPSS Score
0.002
Published
2020-05-21
SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak slurmdbd.conf permissions.
CVSS Score
5.5
EPSS Score
0.0
Published
2020-01-13
SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 executes srun --uid with incorrect privileges.
CVSS Score
7.5
EPSS Score
0.004
Published
2020-01-13
SchedMD Slurm 17.11.x, 18.08.0 through 18.08.7, and 19.05.0 allows SQL Injection.
CVSS Score
9.8
EPSS Score
0.046
Published
2019-07-11
SchedMD Slurm before 17.11.13 and 18.x before 18.08.5 mishandles 32-bit systems.
CVSS Score
9.8
EPSS Score
0.005
Published
2019-01-31