CVE-2023-49937

NameCVE-2023-49937
DescriptionAn issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. Because of a double free, attackers can cause a denial of service or possibly execute arbitrary code. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5609-1
Debian Bugs1058720

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
slurm-llnl (PTS)buster, buster (security)18.08.5.2-1+deb10u2vulnerable
slurm-wlm (PTS)bullseye (security), bullseye20.11.7+really20.11.4-2+deb11u1vulnerable
bookworm, bookworm (security)22.05.8-4+deb12u2fixed
trixie23.11.4-2fixed
sid23.11.7-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
slurm-llnlsourcebuster(unfixed)end-of-life
slurm-llnlsource(unstable)(unfixed)
slurm-wlmsourcebullseye(unfixed)end-of-life
slurm-wlmsourcebookworm22.05.8-4+deb12u2DSA-5609-1
slurm-wlmsource(unstable)23.11.3-11058720

Notes

[bullseye] - slurm-wlm <end-of-life> (see #1071127)
[buster] - slurm-llnl <end-of-life> (EOL in buster LTS)
https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html

Search for package or bug name: Reporting problems