Advisoriesby IbisAWSGHSA-qxh2-h6cj-g562
Security vulnerability in a third party software, Slurm < 20.02.07 and 20.11.7
Fix: upgrade to 20.02.07and20.11.7 or later
AWS ParallelCluster version 2.10.4 was released in order to update the Slurm package to version 20.02.7. This change was made in response to SchedMD’s release of Slurm versions 20.02.7 and 20.11.7 on 2021-05-12 to provide bug fixes as well as a security fix related to the use of Slurm Prolog and Epilog scripts in multi-user environments (https://groups.google.com/g/slurm-users/c/0kPOtrvHrkE?pli=1).
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Slurm Product | < 20.02.07and20.11.7 | 20.02.07and20.11.7 |
Details and references
- Severity from
- GitHub (reviewed advisory)
More AWS advisories
All AWS
Security vulnerability in a third party software, Slurm < 20.11.9 and 21.08.8GHSA-x775-rxcq-38x8fixed in 20.11.9Potential denial of service when sending version negotiation or close packetsGHSA-gj4j-vp5f-86cffixed in v1.1.1Allocated memory not freed when session ticket is usedGHSA-q4mv-c662-pgwgfixed in v0.10.23Predictable IV in CBC-mode composite cipher suitesGHSA-7gxc-93xj-596hfixed in v0.10.19Online Certificate Stapling Protocol (OCSP) Revocation check bypassGHSA-7v2g-v7wj-26jgfixed in v0.10.19Server denial-of-service via crafted handshake messageGHSA-j875-5qwx-w645fixed in v0.10.19