Your message dated Thu, 9 Aug 2018 18:15:20 +0200
with message-id <20180809161520.GA32640@ischia>
and subject line Re: Bug#893044: closing 893044
has caused the Debian Bug report #893044,
regarding slurm-llnl: CVE-2018-7033: Issue in accounting_storage/mysql plugin
by always escaping strings within the slurmdbd
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
893044: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=893044
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: slurm-llnl
Version: 14.03.9-5
Severity: grave
Tags: patch security upstream
Forwarded: https://bugs.schedmd.com/show_bug.cgi?id=4792
Hi,
the following vulnerability was published for slurm-llnl, filling as
grave to be on safe side, but details are yet not disclosed in the
upstream report.
CVE-2018-7033[0]:
|Issue in accounting_storage/mysql plugin by always escaping strings
|within the slurmdbd
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2018-7033
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7033
[1] https://bugs.schedmd.com/show_bug.cgi?id=4792
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Package: slurm-llnl
Version: 14.03.9-5+deb8u4
Hi Stephane,
On Mon, Jul 30, 2018 at 11:07:21AM +0200, Stephane Vaillant wrote:
> The problem seems to be located in CVE-2018-7033-2.patch (provided in the
> slurm-llnl_14.03.9-5+deb8u3.debian.tar.xz archive) :
> - if (gres_req)
> - xstrcat(query, ", gres_req");
> - if (gres_alloc)
> - xstrcat(query, ", gres_alloc");
> + if (job_ptr->gres_req)
> + xstrcat(query, ", job_ptr->gres_req");
> + if (job_ptr->gres_alloc)
> + xstrcat(query, ", job_ptr->gres_alloc");
the patch was fixed, by quoting the columns name.
Thank you for your investigations and report.
Best regards,
--
Gennaro Oliva
--- End Message ---
