Security update for slurm_18_08 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2021:0096-1 Final 1 1 2021-01-17T09:27:54Z current 2021-01-17T09:27:54Z 2021-01-17T09:27:54Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for slurm_18_08 This update for slurm_18_08 fixes the following issues: Security issues fixed: - CVE-2020-27745: Fixed a potential buffer overflow from use of unpackmem (bsc#1178890). - CVE-2020-27746: Fixed a potential leak of the magic cookie when sent as an argument to the xauth command (bsc#1178891). This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2021-96 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/J42YJUAKDUG5O7YONJOQ2TWDUORC5MXP/ E-Mail link for openSUSE-SU-2021:0096-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1178890 SUSE Bug 1178890 https://bugzilla.suse.com/1178891 SUSE Bug 1178891 https://www.suse.com/security/cve/CVE-2020-27745/ SUSE CVE CVE-2020-27745 page https://www.suse.com/security/cve/CVE-2020-27746/ SUSE CVE CVE-2020-27746 page openSUSE Leap 15.2 libpmi0-18.08.9-lp152.5.1 libslurm33-18.08.9-lp152.5.1 perl-slurm-18.08.9-lp152.5.1 slurm-18.08.9-lp152.5.1 slurm-auth-none-18.08.9-lp152.5.1 slurm-config-18.08.9-lp152.5.1 slurm-config-man-18.08.9-lp152.5.1 slurm-cray-18.08.9-lp152.5.1 slurm-devel-18.08.9-lp152.5.1 slurm-doc-18.08.9-lp152.5.1 slurm-hdf5-18.08.9-lp152.5.1 slurm-lua-18.08.9-lp152.5.1 slurm-munge-18.08.9-lp152.5.1 slurm-node-18.08.9-lp152.5.1 slurm-openlava-18.08.9-lp152.5.1 slurm-pam_slurm-18.08.9-lp152.5.1 slurm-plugins-18.08.9-lp152.5.1 slurm-seff-18.08.9-lp152.5.1 slurm-sjstat-18.08.9-lp152.5.1 slurm-slurmdbd-18.08.9-lp152.5.1 slurm-sql-18.08.9-lp152.5.1 slurm-sview-18.08.9-lp152.5.1 slurm-torque-18.08.9-lp152.5.1 slurm-webdoc-18.08.9-lp152.5.1 libpmi0-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 libslurm33-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 perl-slurm-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-auth-none-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-config-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-config-man-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-cray-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-devel-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-doc-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-hdf5-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-lua-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-munge-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-node-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-openlava-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-pam_slurm-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-plugins-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-seff-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-sjstat-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-slurmdbd-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-sql-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-sview-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-torque-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 slurm-webdoc-18.08.9-lp152.5.1 as a component of openSUSE Leap 15.2 Slurm before 19.05.8 and 20.x before 20.02.6 has an RPC Buffer Overflow in the PMIx MPI plugin. CVE-2020-27745 openSUSE Leap 15.2:libpmi0-18.08.9-lp152.5.1 openSUSE Leap 15.2:libslurm33-18.08.9-lp152.5.1 openSUSE Leap 15.2:perl-slurm-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-auth-none-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-config-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-config-man-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-cray-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-devel-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-doc-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-hdf5-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-lua-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-munge-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-node-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-openlava-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-pam_slurm-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-plugins-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-seff-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-sjstat-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-slurmdbd-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-sql-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-sview-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-torque-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-webdoc-18.08.9-lp152.5.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/J42YJUAKDUG5O7YONJOQ2TWDUORC5MXP/ https://www.suse.com/security/cve/CVE-2020-27745.html CVE-2020-27745 https://bugzilla.suse.com/1178890 SUSE Bug 1178890 Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem. CVE-2020-27746 openSUSE Leap 15.2:libpmi0-18.08.9-lp152.5.1 openSUSE Leap 15.2:libslurm33-18.08.9-lp152.5.1 openSUSE Leap 15.2:perl-slurm-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-auth-none-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-config-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-config-man-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-cray-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-devel-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-doc-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-hdf5-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-lua-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-munge-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-node-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-openlava-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-pam_slurm-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-plugins-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-seff-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-sjstat-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-slurmdbd-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-sql-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-sview-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-torque-18.08.9-lp152.5.1 openSUSE Leap 15.2:slurm-webdoc-18.08.9-lp152.5.1 low 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/J42YJUAKDUG5O7YONJOQ2TWDUORC5MXP/ https://www.suse.com/security/cve/CVE-2020-27746.html CVE-2020-27746 https://bugzilla.suse.com/1178891 SUSE Bug 1178891