Fedora has issued an advisory on May 24: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3ODMJQNY4FAV7G3DSKVIO5KY7Q7DKBPU/ The issue is fixed upstream in 20.11.7. Mageia 8 is also affected.
Whiteboard: (none) => MGA8TOOStatus comment: (none) => Fixed upstream in 20.11.7
New version 20.11.7 landing in updates_testing and Cauldron. Updated slurm packages to fix security issue CVE-2021-31215. Updated packages in core/updates_testing: ======================== slurm-20.11.7-1.mga8 lib(64)slurm36-20.11.7-1.mga8 lib(64)slurm-devel-20.11.7-1.mga8 lib(64)slurm-static-devel-20.11.7-1.mga8 Source RPMs: slurm-20.11.7-1.mga8.src.rpm
CC: (none) => eatdirtAssignee: eatdirt => qa-bugs
Version: Cauldron => 8Whiteboard: MGA8TOO => (none)
A look back in Bugzilla reveals that slurm is a recent addition to Mageia, and there are no earlier updates with test suggestions. According to https://slurm.schedmd.com/overview.html slurm is "an open source, fault-tolerant, and highly scalable cluster management and job scheduling system for large and small Linux clusters." Reading the rest of that page, it becomes obvious that testing even the most basic of operations of slurm is much too complicated for most of QA - or maybe at least for me. I can test for a clean install over the original, and I did do that in VirtualBox. So, I am going to give this an OK and validate, with the advisory in Comment 1. If there is something else I should do, please let me know.
Whiteboard: (none) => MGA8-64-OKCC: (none) => andrewsfarm, sysadmin-bugsKeywords: (none) => validated_update
CC: (none) => ouaurelienKeywords: (none) => advisoryCVE: (none) => CVE-2021-31215
Advisory: ======================== Updated slurm packages fix a security vulnerability: SchedMD Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7 allows remote code execution as SlurmUser because use of a PrologSlurmctld or EpilogSlurmctld script leads to environment mishandling (CVE-2021-31215). References: - https://bugs.mageia.org/show_bug.cgi?id=29040 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31215 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3ODMJQNY4FAV7G3DSKVIO5KY7Q7DKBPU/ ======================== Updated packages in 8/core/updates_testing: ======================== slurm-20.11.7-1.mga8 lib(64)slurm36-20.11.7-1.mga8 lib(64)slurm-devel-20.11.7-1.mga8 lib(64)slurm-static-devel-20.11.7-1.mga8 Source RPMs: slurm-20.11.7-1.mga8.src.rpm
Status comment: Fixed upstream in 20.11.7 => (none)Source RPM: slurm-20.11.2-2.mga9.src.rpm => slurm-20.11.2-1.mga8.src.rpm
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2021-0253.html
Status: NEW => RESOLVEDResolution: (none) => FIXED