Bug#974722: marked as done (slurm-llnl: CVE-2020-27746: X11 forwarding - fix potential leak of the magic cookie when sent as an argument to the xauth command)
Your message dated Sat, 21 Nov 2020 22:00:18 +0000
with message-id <E1kgava-000Is2-NH@fasolo.debian.org>
and subject line Bug#974722: fixed in slurm-wlm 20.02.6-1
has caused the Debian Bug report #974722,
regarding slurm-llnl: CVE-2020-27746: X11 forwarding - fix potential leak of the magic cookie when sent as an argument to the xauth command
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)
--
974722: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=974722
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message ---
Source: slurm-llnl
Version: 19.05.5-2.1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Hi,
The following vulnerability was published for slurm-llnl.
CVE-2020-27746[0]:
| X11 forwarding - avoid unsafe use of magic cookie as arg to xauth
| command
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2020-27746
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27746
[1] https://github.com/SchedMD/slurm/commit/07309deb45c33e735e191faf9dd31cca1054a15c
[2] https://lists.schedmd.com/pipermail/slurm-announce/2020/000045.html
[3] https://www.schedmd.com/news.php?id=240
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: slurm-wlm
Source-Version: 20.02.6-1
Done: Gennaro Oliva <oliva.g@na.icar.cnr.it>
We believe that the bug you reported is fixed in the latest version of
slurm-wlm, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 974722@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Gennaro Oliva <oliva.g@na.icar.cnr.it> (supplier of updated slurm-wlm package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 17 Nov 2020 00:11:42 +0100
Source: slurm-wlm
Binary: libpam-slurm libpam-slurm-adopt libpmi0 libpmi0-dbgsym libpmi0-dev libpmi2-0 libpmi2-0-dbgsym libpmi2-0-dev libslurm-dev libslurm-perl libslurm35 libslurm35-dbgsym libslurmdb-perl slurm-client slurm-client-dbgsym slurm-client-emulator slurm-wlm slurm-wlm-basic-plugins slurm-wlm-basic-plugins-dbgsym slurm-wlm-basic-plugins-dev slurm-wlm-doc slurm-wlm-emulator slurm-wlm-torque slurmctld slurmctld-dbgsym slurmd slurmd-dbgsym slurmdbd slurmdbd-dbgsym sview
Architecture: source amd64 all
Version: 20.02.6-1
Distribution: unstable
Urgency: medium
Maintainer: Debian HPC Team <debian-hpc@lists.debian.org>
Changed-By: Gennaro Oliva <oliva.g@na.icar.cnr.it>
Description:
libpam-slurm - PAM module to authenticate using the SLURM resource manager
libpam-slurm-adopt - PAM module to authenticate users running a SLURM job and track th
libpmi0 - SLURM PMI library implementation
libpmi0-dev - SLURM PMI library implementation development files
libpmi2-0 - SLURM PMI2 library implementation
libpmi2-0-dev - SLURM PMI2 library implementation development files
libslurm-dev - SLURM development files
libslurm-perl - Perl API for SLURM
libslurm35 - Runtime library files for SLURM
libslurmdb-perl - Perl API for the SLURM database
slurm-client - SLURM client side commands
slurm-client-emulator - SLURM client side commands for the emulator
slurm-wlm - Simple Linux Utility for Resource Management
slurm-wlm-basic-plugins - SLURM basic plugins
slurm-wlm-basic-plugins-dev - SLURM basic plugins development files
slurm-wlm-doc - SLURM documentation
slurm-wlm-emulator - SLURM emulator
slurm-wlm-torque - Torque compatibility wrappers for SLURM
slurmctld - SLURM central management daemon
slurmd - SLURM compute node daemon
slurmdbd - Secure enterprise-wide interface to a database for SLURM
sview - GUI to view and modify SLURM state
Closes: 949734 974721 974722
Changes:
slurm-wlm (20.02.6-1) unstable; urgency=medium
.
* New upstream release (Closes: #974721, #974722)
* Refresh miscellanea-manpages and mail-path patches
* Remove use-python3 patch included upstream
* Remove smap command
* Remove cray.conf.5 man page
* Bump libslurm to soname 35
* Update configurators
* Fix the slurmdbd example file (Closes: #949734)
* Remove llnl from the source package name and from the
configuration, lib and log directory names
* Remove PM Green patch: bug fixed upstream
* Update d/copyright
* Update libslurm35.symbols
Checksums-Sha1:
cf5b79868daabf4ad71ab8f3cc4d2a8ab4b40d5c 3622 slurm-wlm_20.02.6-1.dsc
99f635b528ce120f10efd432019b3b7270a0f9b3 8891120 slurm-wlm_20.02.6.orig.tar.gz
af0651fc54da555adc01609421f5e33917322e32 125808 slurm-wlm_20.02.6-1.debian.tar.xz
c24829948ee623f4373ba9cfc826c06ea5d87c78 30948 libpam-slurm-adopt_20.02.6-1_amd64.deb
7fbef07bac858caa57d1d6a76a2e6bdf5a175b85 28872 libpam-slurm_20.02.6-1_amd64.deb
323089c94bd196578e7e4736365b55732475fa61 26320 libpmi0-dbgsym_20.02.6-1_amd64.deb
2597c8f740d4015e1a3505fc1536347542bcfa07 36784 libpmi0-dev_20.02.6-1_amd64.deb
a526357a6f5d4396037d28e972deba88947f57e2 32968 libpmi0_20.02.6-1_amd64.deb
353d55f71f829675f0391636670d750fea4f7c6c 41436 libpmi2-0-dbgsym_20.02.6-1_amd64.deb
ba138f87b6b9c8fa55cb8b5b300973eae8a8f9f4 42760 libpmi2-0-dev_20.02.6-1_amd64.deb
ff477c11f402a6028afb379c364713e6b948e17c 35592 libpmi2-0_20.02.6-1_amd64.deb
2fe09bb0ff619f69306a316471859e76dd57f3ed 908296 libslurm-dev_20.02.6-1_amd64.deb
f3377dc6b835680060f48bf68c778b76c5c130d9 161316 libslurm-perl_20.02.6-1_amd64.deb
b3c2425cd60279c307f53db50eba3e5c3d05c2d7 2296596 libslurm35-dbgsym_20.02.6-1_amd64.deb
d222ebb07a3f6012a1b672de11982dd844e62a27 717456 libslurm35_20.02.6-1_amd64.deb
ff3b00c4ecdbc9cb028f84565614469eb86b2da2 50224 libslurmdb-perl_20.02.6-1_amd64.deb
e33b190d6d71cc4ccb32ccc91e8ae7934a7c73f2 1333064 slurm-client-dbgsym_20.02.6-1_amd64.deb
4965fa61fc3cf139f2f6257f10d56e611087c1fe 382500 slurm-client-emulator_20.02.6-1_amd64.deb
8329eed9e9102b82112fffcdd4dec01fa0cc12e0 693312 slurm-client_20.02.6-1_amd64.deb
198bfa5715f44e3319351b0daa48a46a823a53a9 5430956 slurm-wlm-basic-plugins-dbgsym_20.02.6-1_amd64.deb
6aa3180d29b4a1ab5f577e70bb2d8b803f26d726 1408444 slurm-wlm-basic-plugins-dev_20.02.6-1_amd64.deb
260c2de934977101fc1931ea4761fcca7e14b9f9 1390648 slurm-wlm-basic-plugins_20.02.6-1_amd64.deb
f918d5bef55ee049e2c319e2dab1b169888a9d81 1527104 slurm-wlm-doc_20.02.6-1_all.deb
671c5957e3d9723d8e83586170461a1fad2e498e 594188 slurm-wlm-emulator_20.02.6-1_amd64.deb
7169ba258db71082c48bbefa7e8703ce7dc78d3c 63720 slurm-wlm-torque_20.02.6-1_all.deb
b6bd5c7873955894f9b9c3ca97b43280504cb33e 21455 slurm-wlm_20.02.6-1_amd64.buildinfo
07746edd9a34ee3c4e11d2303f3d19c6c0f387b8 231168 slurm-wlm_20.02.6-1_amd64.deb
db26280dc2bacde18307343697066bc82f7a0fd8 1289900 slurmctld-dbgsym_20.02.6-1_amd64.deb
14fbfda3f23bc7a2e05340363153fea749eb6334 455324 slurmctld_20.02.6-1_amd64.deb
485815f4ded05187f94c238cefb0be95f81189e1 645708 slurmd-dbgsym_20.02.6-1_amd64.deb
cecff0b6faeac50b92ebcb08fbe28a1028adac59 199220 slurmd_20.02.6-1_amd64.deb
13aea17e7be274fe690241ee02f752c57cf42945 114648 slurmdbd-dbgsym_20.02.6-1_amd64.deb
61b30c04bccd356527481ee69a3835579c2d7d56 70824 slurmdbd_20.02.6-1_amd64.deb
08b6482f1ce1b53e4050a7556f70da90002bd5f1 133876 sview_20.02.6-1_amd64.deb
Checksums-Sha256:
ddcd78ae45c0855e9053b347451a3a6a47c1b1a7281c4fbb4f587d6431a9aca9 3622 slurm-wlm_20.02.6-1.dsc
4b671bdf9f80b5648b36b179ac12f04844c48c723ae5f1fd846354e12851baaa 8891120 slurm-wlm_20.02.6.orig.tar.gz
3c20c6d76940f3cbd87e0fed6f0c1bc1557c298ec019307d9407deed09b9c5e0 125808 slurm-wlm_20.02.6-1.debian.tar.xz
85a61f0c230af849cab579ef4d1a0e21ddf9c32bfd6edf2465376f4604256414 30948 libpam-slurm-adopt_20.02.6-1_amd64.deb
9c8409861a31636ffaf2e96a17c7613d8db629f7e0a6f670589291e5eb74facb 28872 libpam-slurm_20.02.6-1_amd64.deb
20857c22414c0c9b724d24fb2dbd6b07c20eb7ed411b6ef022c78f4a736c2d76 26320 libpmi0-dbgsym_20.02.6-1_amd64.deb
9379e995722d9af579a36527f0d4f29e0e827fbcdb6b8ee24428f6a6145ac28d 36784 libpmi0-dev_20.02.6-1_amd64.deb
385e490df09c405e5d72f027ec4a6ed470148f33844d07d67a05afb25b916fdc 32968 libpmi0_20.02.6-1_amd64.deb
fa46447784da2d10f50ef61f29afcadf63820a11767795e0b5393729edd2c8b9 41436 libpmi2-0-dbgsym_20.02.6-1_amd64.deb
55459a8eba91377bacab7c317dae350b42bc8d63a82f2e1ec897689c58ff2fcc 42760 libpmi2-0-dev_20.02.6-1_amd64.deb
28af875d73e1e9c6bdc72b5c5f57f69271d252482e87c50a98d6a3b1e3693f3e 35592 libpmi2-0_20.02.6-1_amd64.deb
d01c4e2f9b17cbcc0f33de436de3d251c836802243030a72c6fa2e8ade6e9d4c 908296 libslurm-dev_20.02.6-1_amd64.deb
ab960e4a7153d541fb0c72f8dfaa55b36355c5d7c7a83a952d0d48f729fd67a3 161316 libslurm-perl_20.02.6-1_amd64.deb
267a07b14a942993621e3622e3d647d9d18f6eaf64a65685cff92d9ab3619556 2296596 libslurm35-dbgsym_20.02.6-1_amd64.deb
d0dfceb5d78f149957f0df78554b1d2ebfc837be24e61f558277365b0a76bf66 717456 libslurm35_20.02.6-1_amd64.deb
031e26740b2b8a8f29fb9d60f2c82801e26380ac17ed48770cadcc7fe131dd3b 50224 libslurmdb-perl_20.02.6-1_amd64.deb
5e971f4ec0ab399af45236414ef901a206385a25f8bd7a4095ca88e018f2af73 1333064 slurm-client-dbgsym_20.02.6-1_amd64.deb
77b7c1eaadc25c493966588f2181dfd798ca1cb4ddf519636fd7e46af56cbdb8 382500 slurm-client-emulator_20.02.6-1_amd64.deb
456450de615310e2a64fc2459bc47d94cdbd6d2937d110356eb63ca82523e65e 693312 slurm-client_20.02.6-1_amd64.deb
afffdb35e4cbec243b8c1fe557eb3e3e1f44c27bc846ceebe0692dc90e9ec71f 5430956 slurm-wlm-basic-plugins-dbgsym_20.02.6-1_amd64.deb
3316d268beb18a447f9ca2155d28fc4eff184efd10d9bd2d07bf29f53cd799c6 1408444 slurm-wlm-basic-plugins-dev_20.02.6-1_amd64.deb
4ca4d7dc972d08af6a11ca39df0ac76acd74f4585deeeb98790e4e1c61e53ccf 1390648 slurm-wlm-basic-plugins_20.02.6-1_amd64.deb
4c72d4d02368c71df55ede04c862b4886f52f724806c11905f4ee279f7bd9567 1527104 slurm-wlm-doc_20.02.6-1_all.deb
f8b74967be4d63d50dc9e2973b72f8be7e9840dc633209b46799a2f790b0d3da 594188 slurm-wlm-emulator_20.02.6-1_amd64.deb
bf5eea98e4bd1b66d398af5d45dc39a1bdf14fc5d514b6926b10f531a4eb4bc7 63720 slurm-wlm-torque_20.02.6-1_all.deb
945778272b70e2d7313f24125daab465fdb3b9d04a9c38c30d103c3e7be0c620 21455 slurm-wlm_20.02.6-1_amd64.buildinfo
432682d404d18caf2d26ed302a3570d1a293343bfc1c72db7dd2f382bbca2418 231168 slurm-wlm_20.02.6-1_amd64.deb
7015dceecf005b85773bec92ea3f441acf43014657eb23a3693974fb6168c265 1289900 slurmctld-dbgsym_20.02.6-1_amd64.deb
feb1f72b33a531481d1098ff0373f988acf7f4b6fa3d0cef39ec02e132e85649 455324 slurmctld_20.02.6-1_amd64.deb
ca81588d49da98c8282f7ec69dbe6f3af94a867c6c6cd20a69b223b2ea331d86 645708 slurmd-dbgsym_20.02.6-1_amd64.deb
fc99bc9ccfe582a2f82526e7932ae32fcbfffb663bf91c8a9cbaefcf7354e511 199220 slurmd_20.02.6-1_amd64.deb
cfde0ff268ac1bcc960bd6033a34d5a3bd2f0c493ed396d33797687599929f47 114648 slurmdbd-dbgsym_20.02.6-1_amd64.deb
accf438c61fb43a597a1137e237d96c37d8ba395c96dc414a92c08cd29b16d0b 70824 slurmdbd_20.02.6-1_amd64.deb
e9d0764a16874e755469a5fd946d709af1e97627f8db7feade84d002042c1158 133876 sview_20.02.6-1_amd64.deb
Files:
11317ecbaae9cc0859651fc4ed3aef56 3622 admin optional slurm-wlm_20.02.6-1.dsc
8146595f89661b73c79f2a46c51c25d1 8891120 admin optional slurm-wlm_20.02.6.orig.tar.gz
2214aae2d66099335a945d992625f196 125808 admin optional slurm-wlm_20.02.6-1.debian.tar.xz
accc98ade8ec09200fb8e63fe92567da 30948 admin optional libpam-slurm-adopt_20.02.6-1_amd64.deb
fc536146797d13f27307e438ef136a7d 28872 admin optional libpam-slurm_20.02.6-1_amd64.deb
8b305206f7c0049d877de2c96e75ac8b 26320 debug optional libpmi0-dbgsym_20.02.6-1_amd64.deb
b8b4036d593dfb89e3f7486824a38ac4 36784 libdevel optional libpmi0-dev_20.02.6-1_amd64.deb
6696460d3a2b6c5796f15099533cb629 32968 libs optional libpmi0_20.02.6-1_amd64.deb
89ed1a457480cf5bf69c20b7d6a69fe2 41436 debug optional libpmi2-0-dbgsym_20.02.6-1_amd64.deb
3d93cb877ebad818f3f65ba234359c29 42760 libdevel optional libpmi2-0-dev_20.02.6-1_amd64.deb
e311ffe58e8b31603788eec2be59ef43 35592 libs optional libpmi2-0_20.02.6-1_amd64.deb
cf36524769664a3845386bc3ee186eba 908296 libdevel optional libslurm-dev_20.02.6-1_amd64.deb
738cacf3ee0fcda6e99764e6d8bc59ef 161316 perl optional libslurm-perl_20.02.6-1_amd64.deb
95525f3e70f26f67b019c024718bf179 2296596 debug optional libslurm35-dbgsym_20.02.6-1_amd64.deb
4d50f8aec08c571a75f86692348850c8 717456 libs optional libslurm35_20.02.6-1_amd64.deb
4bc0f13d8ec541e9e4d60877a8336f26 50224 perl optional libslurmdb-perl_20.02.6-1_amd64.deb
4fa62a26a937d195c4b07c28c4745a1d 1333064 debug optional slurm-client-dbgsym_20.02.6-1_amd64.deb
dc7330076d02b345fad7696f24c783d0 382500 admin optional slurm-client-emulator_20.02.6-1_amd64.deb
96179f3df1a665e16600700f543bd91a 693312 admin optional slurm-client_20.02.6-1_amd64.deb
d768ff8a3dd58ecbe9bbf5ae2f5352dc 5430956 debug optional slurm-wlm-basic-plugins-dbgsym_20.02.6-1_amd64.deb
41a902ae728fefe7d9b902e8449924f2 1408444 devel optional slurm-wlm-basic-plugins-dev_20.02.6-1_amd64.deb
fb5fd4a4220700495bf681fd208aef25 1390648 admin optional slurm-wlm-basic-plugins_20.02.6-1_amd64.deb
512077dd4eaee802f9f3703178c0e48a 1527104 doc optional slurm-wlm-doc_20.02.6-1_all.deb
e85f6f1be47232a9f62719a4eb61da29 594188 admin optional slurm-wlm-emulator_20.02.6-1_amd64.deb
4f4c5afba9f82d5604b3f202dfaa900c 63720 admin optional slurm-wlm-torque_20.02.6-1_all.deb
872066141f88d9c273e5efc7fab176e9 21455 admin optional slurm-wlm_20.02.6-1_amd64.buildinfo
6e538c381114b0c94f06ca4240618d55 231168 admin optional slurm-wlm_20.02.6-1_amd64.deb
8a1c0b6392ed482cc8089eb5b9f5d463 1289900 debug optional slurmctld-dbgsym_20.02.6-1_amd64.deb
90fd7b6e59333f99f9f462114fad5a5c 455324 admin optional slurmctld_20.02.6-1_amd64.deb
48e7c4779e7d554b6ddb616eb73184ea 645708 debug optional slurmd-dbgsym_20.02.6-1_amd64.deb
82baaf1938508db80b15809a5f10b6bb 199220 admin optional slurmd_20.02.6-1_amd64.deb
6f0df90a0fe8d130e2ffb590658f5473 114648 debug optional slurmdbd-dbgsym_20.02.6-1_amd64.deb
c5b32a55e6a0a1fedb95c454d5c8b7ce 70824 admin optional slurmdbd_20.02.6-1_amd64.deb
51ca6b32213b749c33232d5b5ef40dd2 133876 admin optional sview_20.02.6-1_amd64.deb
-----BEGIN PGP SIGNATURE-----
iQJLBAEBCgA1FiEE6zNF9WRBuLgad5h2ffpBrZYZhdcFAl+0W6UXHG9saXZhLmdA
bmEuaWNhci5jbnIuaXQACgkQffpBrZYZhdfsuQ//XiTqgslSem3a5uHeEuU5sCFJ
BN3aKe4VclFIrXo4yM4hNXCRiolUvYqxZgiSTrd2xxjJ7PBd/8/GseihnguCqY2a
XT3XbO/zG3QadaUFwW5vVZC4m5xO/WLDx1JCOSHKa3fjAs3huMgzD/rFbxmM/pIy
H6oSefzB5GpMu9VU2z9eWUmjjf43Br4cC2f91IGgfYL7DHod7MJya3C0Za0rhtfA
97pKpCtYs6+xGrOwgCtQDAvz1UDuoSVwnDvkR9ZCy00otbDq/QlN4EGA0AepYh7j
+W5/+l/8FrBGepLhVgy99uL4dZn2gdUFuaTuu9xaOV0Jd46J1qJAwYZsAhV2bWyB
aD0BfSOM6P0YxMv6VNmH8ucu0q5zs4PAKn5efBTs2REHNRTdaKZnsTw8BnGyeB57
hmvnbkfCBH3ErRTIqJHd3t+AUCwz0/k6PhBdjIKRtKT6rfAgqlP9h15+spxjVRGt
436nNRQgW3YqpYLZF1gie27E9hujmqYNYAtFEEyrtOaZDbwsn2ha9VS7I85CVJW+
RjHy4KRktdSnVgZ5jG5jBIU0GyNZ8fGfX6LBI1H/rn4QPM9L8XsTzwSKblTNxrL4
sXcMKTeKaAJVnCcjkNr201hKg7wlEUp4p7JqM4mGI+HNsoDJJJKCIXSOJA7XgHEr
jffMK5VuW5Q1+6NWzVc=
=Mi/1
-----END PGP SIGNATURE-----
--- End Message ---
Reply to: