Security update for pdsh, slurm_18_08

Announcement ID:	SUSE-SU-2020:0434-1
Rating:	moderate
References:	bsc#1018371 bsc#1065697 bsc#1085240 bsc#1095508 bsc#1123304 bsc#1140709 bsc#1155784 bsc#1158709 bsc#1158798 bsc#1159692 jsc#SLE-7341 jsc#SLE-7342
Cross-References:	CVE-2016-10030 CVE-2017-15566 CVE-2018-10995 CVE-2018-7033 CVE-2019-12838 CVE-2019-19727 CVE-2019-19728 CVE-2019-6438
CVSS scores:	CVE-2016-10030 ( NVD ): 8.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2017-15566 ( NVD ): 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2018-10995 ( SUSE ): 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2018-10995 ( NVD ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVE-2018-7033 ( SUSE ): 4.4 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVE-2018-7033 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-12838 ( SUSE ): 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2019-12838 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-12838 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-19727 ( SUSE ): 4.0 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVE-2019-19727 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2019-19728 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2019-19728 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2019-6438 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-6438 ( NVD ): 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:	HPC Module 12 SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5

An update that solves eight vulnerabilities, contains two features and has two security fixes can now be installed.

Description:

This update for pdsh, slurm_18_08 fixes the following issues:

Slurm was included in the 18.08 release, as "slurm_18_08" package. The version 18.08.9 contains all recent security fixes, including:

• CVE-2019-19728: Fixed a privilege escalation with srun, where --uid might have unintended side effects (bsc#1159692).
• CVE-2019-19727: Fixed permissions of slurmdbd.conf (bsc#1155784).

pdsh was updated to:

• Add support for an alternative SLURM version when building the slurm plugin.

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• HPC Module 12
  zypper in -t patch SUSE-SLE-Module-HPC-12-2020-434=1

Package List:

• HPC Module 12 (aarch64 x86_64)
  • libpmi0_18_08-debuginfo-18.08.9-3.5.1
  • slurm_18_08-devel-18.08.9-3.5.1
  • libslurm33-18.08.9-3.5.1
  • pdsh-2.33-7.18.1
  • pdsh-dshgroup-2.33-7.18.1
  • pdsh-genders-debuginfo-2.33-7.18.1
  • pdsh-slurm_18_08-2.33-7.18.1
  • slurm_18_08-node-18.08.9-3.5.1
  • slurm_18_08-plugins-18.08.9-3.5.1
  • slurm_18_08-pam_slurm-debuginfo-18.08.9-3.5.1
  • slurm_18_08-debugsource-18.08.9-3.5.1
  • slurm_18_08-node-debuginfo-18.08.9-3.5.1
  • slurm_18_08-auth-none-debuginfo-18.08.9-3.5.1
  • slurm_18_08-plugins-debuginfo-18.08.9-3.5.1
  • slurm_18_08-slurmdbd-18.08.9-3.5.1
  • slurm_18_08-lua-debuginfo-18.08.9-3.5.1
  • perl-slurm_18_08-18.08.9-3.5.1
  • slurm_18_08-sql-18.08.9-3.5.1
  • pdsh-genders-2.33-7.18.1
  • libslurm33-debuginfo-18.08.9-3.5.1
  • slurm_18_08-munge-18.08.9-3.5.1
  • slurm_18_08-torque-debuginfo-18.08.9-3.5.1
  • libpmi0_18_08-18.08.9-3.5.1
  • perl-slurm_18_08-debuginfo-18.08.9-3.5.1
  • slurm_18_08-slurmdbd-debuginfo-18.08.9-3.5.1
  • slurm_18_08-doc-18.08.9-3.5.1
  • pdsh-slurm-debuginfo-2.33-7.18.1
  • slurm_18_08-sql-debuginfo-18.08.9-3.5.1
  • pdsh-debugsource-2.33-7.18.1
  • pdsh-debuginfo-2.33-7.18.1
  • pdsh-slurm_18_08-debuginfo-2.33-7.18.1
  • pdsh-dshgroup-debuginfo-2.33-7.18.1
  • pdsh-netgroup-debuginfo-2.33-7.18.1
  • pdsh-machines-debuginfo-2.33-7.18.1
  • slurm_18_08-auth-none-18.08.9-3.5.1
  • slurm_18_08-pam_slurm-18.08.9-3.5.1
  • pdsh-netgroup-2.33-7.18.1
  • slurm_18_08-munge-debuginfo-18.08.9-3.5.1
  • slurm_18_08-config-18.08.9-3.5.1
  • slurm_18_08-torque-18.08.9-3.5.1
  • slurm_18_08-18.08.9-3.5.1
  • slurm_18_08-lua-18.08.9-3.5.1
  • slurm_18_08-debuginfo-18.08.9-3.5.1
  • pdsh-slurm-2.33-7.18.1
  • pdsh-machines-2.33-7.18.1

References:

• https://www.suse.com/security/cve/CVE-2016-10030.html
• https://www.suse.com/security/cve/CVE-2017-15566.html
• https://www.suse.com/security/cve/CVE-2018-10995.html
• https://www.suse.com/security/cve/CVE-2018-7033.html
• https://www.suse.com/security/cve/CVE-2019-12838.html
• https://www.suse.com/security/cve/CVE-2019-19727.html
• https://www.suse.com/security/cve/CVE-2019-19728.html
• https://www.suse.com/security/cve/CVE-2019-6438.html
• https://bugzilla.suse.com/show_bug.cgi?id=1018371
• https://bugzilla.suse.com/show_bug.cgi?id=1065697
• https://bugzilla.suse.com/show_bug.cgi?id=1085240
• https://bugzilla.suse.com/show_bug.cgi?id=1095508
• https://bugzilla.suse.com/show_bug.cgi?id=1123304
• https://bugzilla.suse.com/show_bug.cgi?id=1140709
• https://bugzilla.suse.com/show_bug.cgi?id=1155784
• https://bugzilla.suse.com/show_bug.cgi?id=1158709
• https://bugzilla.suse.com/show_bug.cgi?id=1158798
• https://bugzilla.suse.com/show_bug.cgi?id=1159692
• https://jira.suse.com/browse/SLE-7341
• https://jira.suse.com/browse/SLE-7342