What’s Vulnerable › Vulnerabilities

CVE-2021-43337

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-11-17 · updated 2026-06-17

Description

SchedMD Slurm 21.08.* before 21.08.4 has Incorrect Access Control. On sites using the new AccountingStoreFlags=job_script and/or job_env options, the access control rules in SlurmDBD may permit users to request job scripts and environment files to which they should not have access.

Affected products

• Fedoraproject Fedora: 34, 35
• SchedMD Slurm: from 21.08.0 before 21.08.4 — fixed in 21.08.4

How to fix

Upgrade to a fixed version: SchedMD Slurm 21.08.4. Check the vendor advisory for mitigations.

References

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VY34WSSPRPA6MISNYBZWHSGX2SYSEEE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DUWNGDQTS7AWFI7FIHUWQOYJSD2IQTCG/
• https://lists.schedmd.com/pipermail/slurm-announce/
• https://lists.schedmd.com/pipermail/slurm-announce/2021/000068.html
• https://www.schedmd.com/news.php
• https://www.schedmd.com/news.php?id=256
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VY34WSSPRPA6MISNYBZWHSGX2SYSEEE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DUWNGDQTS7AWFI7FIHUWQOYJSD2IQTCG/
• https://lists.schedmd.com/pipermail/slurm-announce/
• https://lists.schedmd.com/pipermail/slurm-announce/2021/000068.html
• https://www.schedmd.com/news.php
• https://www.schedmd.com/news.php?id=256

Get alerted when CVE-2021-43337 or the next vulnerability affects your stack