CVE-2018-10995

MEDIUM

Slurm < 17.02.11 and 17.1x.x < 17.11.7 - Improper Input Validation

Title source: llm
STIX 2.1

Description

SchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names (aka user_name fields) and group ids (aka gid fields).

References (5)

Core 5
Core References
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4254
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/08/msg00008.html
Vendor Advisory x_refsource_misc
https://www.schedmd.com/news.php?id=203
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/07/msg00029.html

Scores

CVSS v3 5.3
EPSS 0.0174
EPSS Percentile 75.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Details

CWE
CWE-20
Status published
Products (13)
debian/debian_linux 8.0
debian/debian_linux 9.0
schedmd/slurm 17.11.0.0 pre1 (5 CPE variants)
schedmd/slurm 17.11.0.1
schedmd/slurm 17.11.1.1
schedmd/slurm 17.11.1.2
schedmd/slurm 17.11.2.1
schedmd/slurm 17.11.3.1
schedmd/slurm 17.11.3.2
schedmd/slurm 17.11.4.1
... and 3 more
Published May 30, 2018
Tracked Since Feb 18, 2026