Vulnerability Description
Slurm 19.05.x before 19.05.7 and 20.02.x before 20.02.3, in the rare case where Message Aggregation is enabled, allows Authentication Bypass via an Alternate Path or Channel. A race condition allows a user to launch a process as an arbitrary user.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Schedmd | Slurm | >= 19.05.0, < 19.05.7 |
| Fedoraproject | Fedora | 31 |
| Opensuse | Leap | 15.1 |
| Debian | Debian Linux | 9.0 |
References
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00035.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00063.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/01/msg00011.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.schedmd.com/pipermail/slurm-announce/2020/000036.htmlMailing ListRelease NotesVendor Advisory
- https://www.debian.org/security/2021/dsa-4841Third Party Advisory
- https://www.schedmd.com/news.php?id=236Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00035.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00063.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/01/msg00011.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.schedmd.com/pipermail/slurm-announce/2020/000036.htmlMailing ListRelease NotesVendor Advisory
- https://www.debian.org/security/2021/dsa-4841Third Party Advisory
FAQ
What is CVE-2020-12693?
CVE-2020-12693 is a vulnerability with a CVSS score of 8.1 (HIGH). Slurm 19.05.x before 19.05.7 and 20.02.x before 20.02.3, in the rare case where Message Aggregation is enabled, allows Authentication Bypass via an Alternate Path or Channel. A race condition allows a...
How severe is CVE-2020-12693?
CVE-2020-12693 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-12693?
Check the references section above for vendor advisories and patch information. Affected products include: Schedmd Slurm, Fedoraproject Fedora, Opensuse Leap, Debian Debian Linux.