PT-2020-5854 · Schedmd+3 · Slurm+3

Published 2020-10-27 · Updated 2024-06-15 · CVE-2020-27746

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Slurm versions 19.05.7 and earlier, 20.x before 20.02.6

Description: The issue is related to the exposure of sensitive information due to a race condition in a read operation on the /proc filesystem, affecting xauth for X11 magic cookies. This allows an unauthorized actor to access confidential data. The vulnerability is associated with the insecure storage of confidential information.

Recommendations: For Slurm versions 19.05.7 and earlier, update to version 19.05.8 or later. For Slurm versions 20.x before 20.02.6, update to version 20.02.6 or later. As a temporary workaround, consider restricting access to the xauth for X11 magic cookies to minimize the risk of exploitation.

Fix

Race Condition

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-362

CWE-922

Related Identifiers

BDU:2021-01898

CVE-2020-27746

DSA-4841-1

OPENSUSE-SU-2020:2033-1

OPENSUSE-SU-2020:2056-1

OPENSUSE-SU-2020:2286-1

OPENSUSE-SU-2020_2033-1

OPENSUSE-SU-2020_2056-1

OPENSUSE-SU-2020_2286-1

OPENSUSE-SU-2021:0096-1

OPENSUSE-SU-2021_0096-1

OPENSUSE-SU-2024:11389-1

SUSE-SU-2020:3505-1

SUSE-SU-2020:3506-1

SUSE-SU-2020:3863-1

SUSE-SU-2020:3877-1

SUSE-SU-2020:3878-1

SUSE-SU-2020:3892-1

SUSE-SU-2021:0139-1

SUSE-SU-2021:0773-1

USN-4781-1

Affected Products

Linuxmint

Slurm

Suse

Ubuntu

References · 76

• https://osv.dev/vulnerability/openSUSE-SU-2020:2056-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0773-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27746 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0139-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27746 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-27746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27746 · Security Note
• https://ubuntu.com/security/CVE-2021-31215 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11389-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12693 · Vendor Advisory
• https://debian.org/security/2021/dsa-4841 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-6438 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-10030 · Vendor Advisory
• https://schedmd.com/news.php · Vendor Advisory
• https://osv.dev/vulnerability/USN-4781-1 · Vendor Advisory