CVE-2017-15566 — Untrusted Search Path in Slurm

CWE-426 — Untrusted Search Path9 documents6 sources
Severity
7.8HIGHNVD
OSV8.1
EPSS
0.3%
top 49.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Schedmd Slurm
Timeline
PublishedNov 1
Latest updateFeb 1

Description

Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, allowing privilege escalation to root during Prolog or Epilog execution.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages1 packages

▶NVDschedmd/slurm17.02.0 — 17.2.09+2

🔴Vulnerability Details

5
OSV
slurm-llnl vulnerabilities↗2023-02-01
▶
OSV
slurm-llnl vulnerabilities↗2022-05-25
▶
GHSA
GHSA-h3p2-v728-89g5: Insecure SPANK environment variable handling exists in SchedMD Slurm before 16↗2022-05-13
▶
OSV
CVE-2017-15566: Insecure SPANK environment variable handling exists in SchedMD Slurm before 16↗2017-11-01
▶
CVEList
CVE-2017-15566: Insecure SPANK environment variable handling exists in SchedMD Slurm before 16↗2017-11-01
▶

📋Vendor Advisories

2
Ubuntu
Slurm vulnerabilities↗2023-02-01
▶
Ubuntu
Slurm vulnerabilities↗2022-05-25
▶

💬Community

1
Bugzilla
CVE-2017-15566 slurm: privilege escalation vulnerability↗2017-11-01
▶
CVE-2017-15566 — Untrusted Search Path in Schedmd Slurm | cvebase