CVE-2023-41914

NameCVE-2023-41914
DescriptionSchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 allows filesystem race conditions for gaining ownership of a file, overwriting a file, or deleting files.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5529-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
slurm-llnl (PTS)buster, buster (security)18.08.5.2-1+deb10u2vulnerable
slurm-wlm (PTS)bullseye (security), bullseye20.11.7+really20.11.4-2+deb11u1vulnerable
bookworm, bookworm (security)22.05.8-4+deb12u2fixed
trixie23.11.4-2fixed
sid23.11.7-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
slurm-llnlsourcebuster(unfixed)end-of-life
slurm-llnlsource(unstable)(unfixed)
slurm-wlmsourcebullseye(unfixed)end-of-life
slurm-wlmsourcebookworm22.05.8-4+deb12u1DSA-5529-1
slurm-wlmsource(unstable)23.02.6-1

Notes

[bullseye] - slurm-wlm <end-of-life> (see #1071127)
[buster] - slurm-llnl <end-of-life> (EOL in buster LTS)
https://groups.google.com/g/slurm-users/c/N9WHFVefSHA
slurm-wlm-contrib also changed, but actual security issue is in slurm-wlm

Search for package or bug name: Reporting problems