CVE-2017-15566

Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, allowing privilege escalation to root during Prolog or Epilog execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 35%
VendorProductVersion
schedmdslurm
𝑥
< 16.05.11
schedmdslurm
17.02.0 ≤
𝑥
< 17.2.09
schedmdslurm
17.11.0:rc1
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
slurm-llnl
jammy
dne
impish
dne
hirsute
dne
groovy
not-affected
focal
not-affected
eoan
dne
disco
not-affected
cosmic
not-affected
bionic
not-affected
artful
ignored
zesty
ignored
xenial
Fixed 15.08.7-1ubuntu0.1~esm3
released
trusty
not-affected
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/101675
https://www.debian.org/security/2017/dsa-4023
https://www.schedmd.com/news.php?id=193#OPT_193
http://www.securityfocus.com/bid/101675
https://www.debian.org/security/2017/dsa-4023
https://www.schedmd.com/news.php?id=193#OPT_193