CVE-2017-15566: High severity SchedMD Slurm vulnerability
Published Nov 1, 2017
·Updated
Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, allowing privilege escalation to root during Prolog or Epilog execution.
Affected Software
5 affected componentsFixes available
debian/slurm-llnl<=17.02.7-1, <=16.05.9-1
17.02.9-116.05.9-1+deb9u1
debian/slurm-llnl
18.08.5.2-1+deb10u2
SchedMD Slurm<16.05.11
SchedMD Slurm>=17.02.0<17.2.09
SchedMD Slurm=17.11.0-rc1
Event History
Nov 1, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-15566?
CVE-2017-15566 is considered to have a high severity due to its potential for privilege escalation to root.
2
How do I fix CVE-2017-15566?
To fix CVE-2017-15566, upgrade to Slurm versions 16.05.11, 17.02.9, or 17.11.0rc2 or later.
3
Which versions of Slurm are affected by CVE-2017-15566?
Slurm versions prior to 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2 are affected by CVE-2017-15566.
4
What type of vulnerability is CVE-2017-15566?
CVE-2017-15566 is an insecure environment variable handling vulnerability that can lead to privilege escalation.
5
Is CVE-2017-15566 specific to any operating system?
CVE-2017-15566 primarily affects the Slurm workload manager across various Linux distributions, notably Debain.