Security update for slurm SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:2602-1 Final 1 1 2020-09-10T13:31:06Z current 2020-09-10T13:31:06Z 2020-09-10T13:31:06Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for slurm This update for slurm fixes the following issues: - Fix Authentication Bypass when Message Aggregation is enabled CVE-2020-12693 This fixes and issue where authentication could be bypassed via an alternate path or channel when message Aggregation was enabled. A race condition allowed a user to launch a process as an arbitrary user. Add: Fix-Authentication-Bypass-when-Message-Aggregation-is-enabled-CVE-2020-12693.patch (CVE-2020-12693, bsc#1172004). - Remove unneeded build dependency to postgresql-devel. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-2602,SUSE-SLE-Module-HPC-15-SP1-2020-2602,SUSE-SLE-Product-HPC-15-2020-2602 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20202602-1/ Link for SUSE-SU-2020:2602-1 https://lists.suse.com/pipermail/sle-security-updates/2020-September/007403.html E-Mail link for SUSE-SU-2020:2602-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1172004 SUSE Bug 1172004 https://www.suse.com/security/cve/CVE-2019-19727/ SUSE CVE CVE-2019-19727 page https://www.suse.com/security/cve/CVE-2020-12693/ SUSE CVE CVE-2020-12693 page SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Module for HPC 15 SP1 libpmi0-17.11.13-6.31.1 libslurm32-17.11.13-6.31.1 perl-slurm-17.11.13-6.31.1 slurm-17.11.13-6.31.1 slurm-auth-none-17.11.13-6.31.1 slurm-config-17.11.13-6.31.1 slurm-devel-17.11.13-6.31.1 slurm-doc-17.11.13-6.31.1 slurm-lua-17.11.13-6.31.1 slurm-munge-17.11.13-6.31.1 slurm-node-17.11.13-6.31.1 slurm-openlava-17.11.13-6.31.1 slurm-pam_slurm-17.11.13-6.31.1 slurm-plugins-17.11.13-6.31.1 slurm-seff-17.11.13-6.31.1 slurm-sjstat-17.11.13-6.31.1 slurm-slurmdbd-17.11.13-6.31.1 slurm-sql-17.11.13-6.31.1 slurm-sview-17.11.13-6.31.1 slurm-torque-17.11.13-6.31.1 libpmi0-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libslurm32-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS perl-slurm-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS slurm-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS slurm-auth-none-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS slurm-config-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS slurm-devel-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS slurm-doc-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS slurm-lua-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS slurm-munge-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS slurm-node-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS slurm-pam_slurm-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS slurm-plugins-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS slurm-slurmdbd-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS slurm-sql-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS slurm-torque-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libpmi0-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libslurm32-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS perl-slurm-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS slurm-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS slurm-auth-none-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS slurm-config-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS slurm-devel-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS slurm-doc-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS slurm-lua-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS slurm-munge-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS slurm-node-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS slurm-pam_slurm-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS slurm-plugins-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS slurm-slurmdbd-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS slurm-sql-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS slurm-torque-17.11.13-6.31.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libslurm32-17.11.13-6.31.1 as a component of SUSE Linux Enterprise Module for HPC 15 SP1 SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak slurmdbd.conf permissions. CVE-2019-19727 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libpmi0-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libslurm32-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:perl-slurm-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-auth-none-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-config-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-devel-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-doc-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-lua-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-munge-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-node-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-pam_slurm-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-plugins-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-slurmdbd-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-sql-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-torque-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libpmi0-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libslurm32-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:perl-slurm-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-auth-none-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-config-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-devel-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-doc-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-lua-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-munge-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-node-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-pam_slurm-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-plugins-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-slurmdbd-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-sql-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-torque-17.11.13-6.31.1 SUSE Linux Enterprise Module for HPC 15 SP1:libslurm32-17.11.13-6.31.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20202602-1/ https://www.suse.com/security/cve/CVE-2019-19727.html CVE-2019-19727 https://bugzilla.suse.com/1155784 SUSE Bug 1155784 Slurm 19.05.x before 19.05.7 and 20.02.x before 20.02.3, in the rare case where Message Aggregation is enabled, allows Authentication Bypass via an Alternate Path or Channel. A race condition allows a user to launch a process as an arbitrary user. CVE-2020-12693 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libpmi0-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libslurm32-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:perl-slurm-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-auth-none-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-config-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-devel-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-doc-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-lua-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-munge-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-node-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-pam_slurm-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-plugins-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-slurmdbd-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-sql-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:slurm-torque-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libpmi0-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libslurm32-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:perl-slurm-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-auth-none-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-config-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-devel-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-doc-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-lua-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-munge-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-node-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-pam_slurm-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-plugins-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-slurmdbd-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-sql-17.11.13-6.31.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:slurm-torque-17.11.13-6.31.1 SUSE Linux Enterprise Module for HPC 15 SP1:libslurm32-17.11.13-6.31.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20202602-1/ https://www.suse.com/security/cve/CVE-2020-12693.html CVE-2020-12693 https://bugzilla.suse.com/1172004 SUSE Bug 1172004 https://bugzilla.suse.com/1173804 SUSE Bug 1173804