CVE-2022-29500: SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure

High severity · published May 5, 2022

CVE-2022-29500

SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure

8.8

CVSS

2.3%

EPSS

On KEV

Description

SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.3% · higher than 83% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Debian Linux · Debian

11.0 · source: NVD

Fedora · Fedoraproject

34; 35; 36 · source: NVD

Slurm · Schedmd

before 20.11.9; 21.08.0 before 21.08.08 · source: NVD

Affected product

Debian Linux

Debian

All Debian Linux CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-29500

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-29500

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HXLOI3ERTKMZR2KWNRN7OR5S55VPWENH/

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y6B7OWVNVCJUDE6VDWGCBUWMRCRETAO3/

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YBI4NFDGGMBKWG4EMSZL5UHATDCLPCQW/

Mailing List

https://lists.schedmd.com/pipermail/slurm-announce/

Third Party Advisory

https://www.debian.org/security/2022/dsa-5166

Mitigation

https://www.schedmd.com/news.php