CVE-2023-49933

NameCVE-2023-49933
DescriptionAn issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5609-1
Debian Bugs1058720

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
slurm-wlm (PTS)bullseye (security), bullseye20.11.7+really20.11.4-2+deb11u1vulnerable
bookworm, bookworm (security)22.05.8-4+deb12u2fixed
trixie24.05.4-1fixed
sid24.11.0-1.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
slurm-llnlsourcebuster(unfixed)end-of-life
slurm-llnlsource(unstable)(unfixed)
slurm-wlmsourcebullseye(unfixed)end-of-life
slurm-wlmsourcebookworm22.05.8-4+deb12u2DSA-5609-1
slurm-wlmsource(unstable)23.11.3-11058720

Notes

[bullseye] - slurm-wlm <end-of-life> (see #1071127)
[buster] - slurm-llnl <end-of-life> (EOL in buster LTS)
https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html

Search for package or bug name: Reporting problems