CVE-2018-10995 SchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names (aka user_name fields) and group ids (aka gid fields).
MediumCVSS 5.3
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names (aka user_name fields) and group ids (aka gid fields).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schedmd slurm | <= 17.02.10.1 | No fix listed |
| schedmd slurm | = 17.11.0.0-pre1 | No fix listed |
| schedmd slurm | = 17.11.0.0-pre2 | No fix listed |
| schedmd slurm | = 17.11.0.0-rc1 | No fix listed |
| schedmd slurm | = 17.11.0.0-rc2 | No fix listed |
| schedmd slurm | = 17.11.0.0-rc3 | No fix listed |
| schedmd slurm | = 17.11.0.1 | No fix listed |
| schedmd slurm | = 17.11.1.1 | No fix listed |
| schedmd slurm | = 17.11.1.2 | No fix listed |
| schedmd slurm | = 17.11.2.1 | No fix listed |
| schedmd slurm | = 17.11.3.1 | No fix listed |
| schedmd slurm | = 17.11.3.2 | No fix listed |
| schedmd slurm | = 17.11.4.1 | No fix listed |
| schedmd slurm | = 17.11.5.1 | No fix listed |
| schedmd slurm | = 17.11.6.1 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- [debian-lts-announce] 20180721 [SECURITY] [DLA 1437-1] slurm-llnl security update mailing-list third-party-advisory
- [debian-lts-announce] 20180808 [SECURITY] [DLA 1437-2] slurm-llnl regression update mailing-list third-party-advisory
- lists.schedmd.com vendor-advisory
- DSA-4254 third-party-advisory vendor-advisory
- www.schedmd.com vendor-advisory