PT-2021-23816 · Schedmd · Schedmd Slurm

Published 2021-11-17 · Updated 2022-12-08 · CVE-2021-43337

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SchedMD Slurm versions 21.08.* through 21.08.3

Description The issue concerns incorrect access control in SchedMD Slurm. Specifically, on sites using the new AccountingStoreFlags options for job scripts and/or job environment, the access control rules in SlurmDBD may allow users to access job scripts and environment files that they should not have access to.

Recommendations For SchedMD Slurm versions 21.08.* through 21.08.3, update to version 21.08.4 to resolve the issue.

Fix

Related Identifiers

CVE-2021-43337

OPENSUSE-SU-2024:11645-1

SUSE-RU-2022:4297-1

SUSE-RU-2022:4348-1

SUSE-RU-2022:4361-1

SUSE-RU-2022:4362-1

Affected Products

Schedmd Slurm

References · 25

• https://osv.dev/vulnerability/SUSE-RU-2022:4361-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2022:4362-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DUWNGDQTS7AWFI7FIHUWQOYJSD2IQTCG · Vendor Advisory
• https://lists.schedmd.com/pipermail/slurm-announce · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43337 · Vendor Advisory
• https://schedmd.com/news.php · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-43337 · Security Note
• https://lists.schedmd.com/pipermail/slurm-announce/2021/000068.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-43337 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43337 · Security Note
• https://osv.dev/vulnerability/SUSE-RU-2022:4348-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-RU-2022:4297-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-43337 · Vendor Advisory
• https://schedmd.com/news.php?id=256 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VY34WSSPRPA6MISNYBZWHSGX2SYSEEE · Vendor Advisory