Security update for slurm_18_08 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:2600-1 Final 1 1 2020-09-10T13:30:02Z current 2020-09-10T13:30:02Z 2020-09-10T13:30:02Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for slurm_18_08 This update for slurm_18_08 fixes the following issues: - Fix Authentication Bypass when Message Aggregation is enabled CVE-2020-12693 This fixes and issue where authentication could be bypassed via an alternate path or channel when message Aggregation was enabled. A race condition allowed a user to launch a process as an arbitrary user. Add: Fix-Authentication-Bypass-when-Message-Aggregation-is-enabled-CVE-2020-12693.patch (CVE-2020-12693, bsc#1172004). - Remove unneeded build dependency to postgresql-devel. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-2600,SUSE-SLE-Module-HPC-12-2020-2600 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20202600-1/ Link for SUSE-SU-2020:2600-1 https://lists.suse.com/pipermail/sle-security-updates/2020-September/007401.html E-Mail link for SUSE-SU-2020:2600-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1172004 SUSE Bug 1172004 https://www.suse.com/security/cve/CVE-2020-12693/ SUSE CVE CVE-2020-12693 page SUSE Linux Enterprise Module for HPC 12 libpmi0_18_08-18.08.9-3.8.1 libslurm33-18.08.9-3.8.1 perl-slurm_18_08-18.08.9-3.8.1 slurm_18_08-18.08.9-3.8.1 slurm_18_08-auth-none-18.08.9-3.8.1 slurm_18_08-config-18.08.9-3.8.1 slurm_18_08-config-man-18.08.9-3.8.1 slurm_18_08-cray-18.08.9-3.8.1 slurm_18_08-devel-18.08.9-3.8.1 slurm_18_08-doc-18.08.9-3.8.1 slurm_18_08-lua-18.08.9-3.8.1 slurm_18_08-munge-18.08.9-3.8.1 slurm_18_08-node-18.08.9-3.8.1 slurm_18_08-openlava-18.08.9-3.8.1 slurm_18_08-pam_slurm-18.08.9-3.8.1 slurm_18_08-plugins-18.08.9-3.8.1 slurm_18_08-seff-18.08.9-3.8.1 slurm_18_08-sjstat-18.08.9-3.8.1 slurm_18_08-slurmdbd-18.08.9-3.8.1 slurm_18_08-sql-18.08.9-3.8.1 slurm_18_08-sview-18.08.9-3.8.1 slurm_18_08-torque-18.08.9-3.8.1 slurm_18_08-webdoc-18.08.9-3.8.1 libpmi0_18_08-18.08.9-3.8.1 as a component of SUSE Linux Enterprise Module for HPC 12 libslurm33-18.08.9-3.8.1 as a component of SUSE Linux Enterprise Module for HPC 12 perl-slurm_18_08-18.08.9-3.8.1 as a component of SUSE Linux Enterprise Module for HPC 12 slurm_18_08-18.08.9-3.8.1 as a component of SUSE Linux Enterprise Module for HPC 12 slurm_18_08-auth-none-18.08.9-3.8.1 as a component of SUSE Linux Enterprise Module for HPC 12 slurm_18_08-config-18.08.9-3.8.1 as a component of SUSE Linux Enterprise Module for HPC 12 slurm_18_08-devel-18.08.9-3.8.1 as a component of SUSE Linux Enterprise Module for HPC 12 slurm_18_08-doc-18.08.9-3.8.1 as a component of SUSE Linux Enterprise Module for HPC 12 slurm_18_08-lua-18.08.9-3.8.1 as a component of SUSE Linux Enterprise Module for HPC 12 slurm_18_08-munge-18.08.9-3.8.1 as a component of SUSE Linux Enterprise Module for HPC 12 slurm_18_08-node-18.08.9-3.8.1 as a component of SUSE Linux Enterprise Module for HPC 12 slurm_18_08-pam_slurm-18.08.9-3.8.1 as a component of SUSE Linux Enterprise Module for HPC 12 slurm_18_08-plugins-18.08.9-3.8.1 as a component of SUSE Linux Enterprise Module for HPC 12 slurm_18_08-slurmdbd-18.08.9-3.8.1 as a component of SUSE Linux Enterprise Module for HPC 12 slurm_18_08-sql-18.08.9-3.8.1 as a component of SUSE Linux Enterprise Module for HPC 12 slurm_18_08-torque-18.08.9-3.8.1 as a component of SUSE Linux Enterprise Module for HPC 12 Slurm 19.05.x before 19.05.7 and 20.02.x before 20.02.3, in the rare case where Message Aggregation is enabled, allows Authentication Bypass via an Alternate Path or Channel. A race condition allows a user to launch a process as an arbitrary user. CVE-2020-12693 SUSE Linux Enterprise Module for HPC 12:libpmi0_18_08-18.08.9-3.8.1 SUSE Linux Enterprise Module for HPC 12:libslurm33-18.08.9-3.8.1 SUSE Linux Enterprise Module for HPC 12:perl-slurm_18_08-18.08.9-3.8.1 SUSE Linux Enterprise Module for HPC 12:slurm_18_08-18.08.9-3.8.1 SUSE Linux Enterprise Module for HPC 12:slurm_18_08-auth-none-18.08.9-3.8.1 SUSE Linux Enterprise Module for HPC 12:slurm_18_08-config-18.08.9-3.8.1 SUSE Linux Enterprise Module for HPC 12:slurm_18_08-devel-18.08.9-3.8.1 SUSE Linux Enterprise Module for HPC 12:slurm_18_08-doc-18.08.9-3.8.1 SUSE Linux Enterprise Module for HPC 12:slurm_18_08-lua-18.08.9-3.8.1 SUSE Linux Enterprise Module for HPC 12:slurm_18_08-munge-18.08.9-3.8.1 SUSE Linux Enterprise Module for HPC 12:slurm_18_08-node-18.08.9-3.8.1 SUSE Linux Enterprise Module for HPC 12:slurm_18_08-pam_slurm-18.08.9-3.8.1 SUSE Linux Enterprise Module for HPC 12:slurm_18_08-plugins-18.08.9-3.8.1 SUSE Linux Enterprise Module for HPC 12:slurm_18_08-slurmdbd-18.08.9-3.8.1 SUSE Linux Enterprise Module for HPC 12:slurm_18_08-sql-18.08.9-3.8.1 SUSE Linux Enterprise Module for HPC 12:slurm_18_08-torque-18.08.9-3.8.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20202600-1/ https://www.suse.com/security/cve/CVE-2020-12693.html CVE-2020-12693 https://bugzilla.suse.com/1172004 SUSE Bug 1172004 https://bugzilla.suse.com/1173804 SUSE Bug 1173804