CVE-2021-43337

Description

SchedMD Slurm 21.08.* before 21.08.4 has Incorrect Access Control. On sites using the new AccountingStoreFlags=job_script and/or job_env options, the access control rules in SlurmDBD may permit users to request job scripts and environment files to which they should not have access.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP4	pdsh +1	2.34-150300.35.2	SUSE-RU-2022:4361-1
SLES 15 SP4	slurm_22_05	22.05.5-150300.7.3.2	SUSE-RU-2022:4361-1
SLES 15 SP3	pdsh +1	2.34-150300.35.2	SUSE-RU-2022:4361-1
SLES 15 SP3	slurm_22_05	22.05.5-150300.7.3.2	SUSE-RU-2022:4361-1
SLES 12	pdsh	2.34-7.35.2	SUSE-RU-2022:4348-1
SLES 12	pdsh_slurm_18_08 +2	2.34-7.35.3	SUSE-RU-2022:4348-1
SLES 12	pdsh_slurm_22_05	2.34-7.35.5	SUSE-RU-2022:4348-1
SLES 12	slurm_22_05	22.05.5-3.3.5	SUSE-RU-2022:4348-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SLE HPC 15 SP2	pdsh +1	2.34-150200.4.6.2	SUSE-RU-2022:4362-1
SLE HPC 15 SP2	slurm_22_05	22.05.5-150200.5.3.2	SUSE-RU-2022:4362-1
SLE HPC 15 SP1	pdsh +2	2.34-150100.10.14.1	SUSE-RU-2022:4297-1
SLE HPC 15 SP1	slurm_22_05	22.05.5-150100.3.3.1	SUSE-RU-2022:4297-1

openSUSE