CVE-2023-49938

NameCVE-2023-49938
DescriptionAn issue was discovered in SchedMD Slurm 22.05.x and 23.02.x. There is Incorrect Access Control: an attacker can modified their extended group list that is used with the sbcast subsystem, and open files with an unauthorized set of extended groups. The fixed versions are 22.05.11 and 23.02.7.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5609-1
Debian Bugs1058720

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
slurm-llnl (PTS)buster, buster (security)18.08.5.2-1+deb10u2vulnerable
slurm-wlm (PTS)bullseye (security), bullseye20.11.7+really20.11.4-2+deb11u1vulnerable
bookworm, bookworm (security)22.05.8-4+deb12u2fixed
trixie23.11.4-2fixed
sid23.11.7-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
slurm-llnlsourcebuster(unfixed)end-of-life
slurm-llnlsource(unstable)(unfixed)
slurm-wlmsourcebullseye(unfixed)end-of-life
slurm-wlmsourcebookworm22.05.8-4+deb12u2DSA-5609-1
slurm-wlmsource(unstable)23.11.3-11058720

Notes

[bullseye] - slurm-wlm <end-of-life> (see #1071127)
[buster] - slurm-llnl <end-of-life> (EOL in buster LTS)
https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html

Search for package or bug name: Reporting problems