CVE-2017-15566

moderate-risk

Published 2017-11-01

Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, allowing privilege escalation to root during Prolog or Epilog execution.

Do I need to act?

0.27% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.8/10 High

LOCAL / LOW complexity

Affected Products (2)

Slurm

Affected Vendors

Schedmd

References (6)

Third Party Advisory http://www.securityfocus.com/bid/101675

Third Party Advisory https://www.debian.org/security/2017/dsa-4023

Vendor Advisory https://www.schedmd.com/news.php?id=193#OPT_193

Third Party Advisory http://www.securityfocus.com/bid/101675

Third Party Advisory https://www.debian.org/security/2017/dsa-4023

Vendor Advisory https://www.schedmd.com/news.php?id=193#OPT_193

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 1/34 · Minimal

Exposure 7/34 · Low