CVE-2021-31215

Name of the Vulnerable Software and Affected Versions SchedMD Slurm versions 20.03.x through 20.11.x before 20.11.7 SchedMD Slurm versions prior to 20.02.7

Description The issue is related to the incorrect handling of environment variables in PrologSlurmctld and EpilogSlurmctld scripts of the SLURM resource management tool. This can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability can lead to remote code execution as SlurmUser due to the mishandling of environment variables when using these scripts.

Recommendations For SchedMD Slurm versions prior to 20.02.7, update to version 20.02.7 or later. For SchedMD Slurm versions 20.03.x through 20.11.x before 20.11.7, update to version 20.11.7 or later. As a temporary workaround, consider disabling the use of PrologSlurmctld and EpilogSlurmctld scripts until a patch is available. Restrict access to sensitive data and monitor for any signs of unauthorized access or denial of service.