CVE-2019-19728

nvd nist

Published: Jan 13, 2020Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: NVD

Description

SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 executes srun --uid with incorrect privileges.

Affected (4)

Products: Schedmd: Slurm · Opensuse: Leap · Debian: Debian Linux

1 product

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Schedmd Slurm	Before 18.08.9
Schedmd Slurm	From 19.05.0 to 19.05.5

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Related CWEs

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (10)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00038.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://bugzilla.suse.com/show_bug.cgi?id=1159692

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://lists.schedmd.com/pipermail/slurm-announce/

Source: cve@mitre.org

Mailing ListVendor Advisory

https://www.debian.org/security/2021/dsa-4841

Source: cve@mitre.org

Third Party Advisory

https://www.schedmd.com/news.php

Source: cve@mitre.org

Vendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00038.html