Every CVE Search/ Get API key

CVE-2023-49935

An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control...

8.8 HighFix available

An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.04%Up 1.0 points since Dec 14, 2023
90%50%10%1%

What each source reports

NVD Score used 8.8

An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.

Record
CVE-2023-49935
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-613
Updated
2026-11-02
CVE List No score

An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.

Record
CVE-2023-49935
Updated
2026-11-02
EUVDEUVD-2023-53830 No score

An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.

Record
EUVD-2023-53830
Updated
2026-11-02
GitHub AdvisoriesGHSA-r926-qjg2-q5jr 8.8

An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control...

An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.

Record
GHSA-r926-qjg2-q5jr
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-613
Updated
2026-11-02
OSVDEBIAN-CVE-2023-49935 8.8

An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.

Record
DEBIAN-CVE-2023-49935
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-49935 8.8

An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.

Record
UBUNTU-CVE-2023-49935
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSV No score

An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.

Record
CVE-2023-49935
Updated
2026-11-02
OSVopenSUSE-SU-2024:13559-1 No score

libnss_slurm2-23.02.7-1.1 on GA media

These are all security issues fixed in the libnss_slurm2-23.02.7-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13559-1
Updated
2026-11-02
OSVSUSE-SU-2024:0280-1 No score

Security update for slurm_23_02

This update for slurm_23_02 fixes the following issues:

Update to slurm 23.02.6:

Security fixes:

  • CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
  • CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049)
  • CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
  • CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
  • CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

  • Add missing service file for slurmrestd (bsc#1217711).
  • Fix slurm upgrading to incompatible versions (bsc#1216869).
Record
SUSE-SU-2024:0280-1
Updated
2026-11-02
OSVSUSE-SU-2024:0284-1 No score

Security update for slurm

This update for slurm fixes the following issues:

Update to slurm 23.02.6:

Security fixes:

  • CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
  • CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049)
  • CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
  • CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
  • CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

  • Add missing service file for slurmrestd (bsc#1217711).
  • Fix slurm upgrading to incompatible versions (bsc#1216869).
Record
SUSE-SU-2024:0284-1
Updated
2026-11-02
OSVSUSE-SU-2024:0289-1 No score

Security update for slurm_23_02

This update for slurm_23_02 fixes the following issues:

Update to slurm 23.02.6:

Security fixes:

  • CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
  • CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049)
  • CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
  • CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
  • CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

  • Add missing service file for slurmrestd (bsc#1217711).
  • Fix slurm upgrading to incompatible versions (bsc#1216869).
Record
SUSE-SU-2024:0289-1
Updated
2026-11-02
OSVSUSE-SU-2024:0312-1 No score

Security update for slurm_23_02

This update for slurm_23_02 fixes the following issues:

Update to slurm 23.02.6:

Security fixes:

  • CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
  • CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049)
  • CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
  • CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
  • CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

  • Add missing service file for slurmrestd (bsc#1217711).
  • Fix slurm upgrading to incompatible versions (bsc#1216869).
Record
SUSE-SU-2024:0312-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
slurm-wlm
Debian:13
 before 23.11.3-1
23.11.3-1
slurm-wlm
Debian:14
 before 23.11.3-1
23.11.3-1
slurm_23_02
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
From an advisory covering 5 CVEs
 before 23.02.7-150300.7.17.1
23.02.7-150300.7.17.1
slurm_23_02
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 5 CVEs
 before 23.02.7-150300.7.17.1
23.02.7-150300.7.17.1
slurm_23_02
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 5 CVEs
 before 23.02.7-150300.7.17.1
23.02.7-150300.7.17.1
slurm
SUSE:Linux Enterprise Module for HPC 15 SP5
From an advisory covering 5 CVEs
 before 23.02.7-150500.5.15.1
23.02.7-150500.5.15.1
slurm
SUSE:Linux Enterprise Module for Package Hub 15 SP5
From an advisory covering 5 CVEs
 before 23.02.7-150500.5.15.1
23.02.7-150500.5.15.1
slurm
openSUSE:Leap 15.5
From an advisory covering 5 CVEs
 before 23.02.7-150500.5.15.1
23.02.7-150500.5.15.1
slurm_23_02
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 5 CVEs
 before 23.02.7-150200.5.17.1
23.02.7-150200.5.17.1
slurm_23_02
SUSE:Linux Enterprise Module for HPC 12
From an advisory covering 5 CVEs
 before 23.02.7-3.16.1
23.02.7-3.16.1
Show 4 moreShow less
Affected packages
PackageAffectedFixed
slurm-llnl
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.5.7-12.5.7-1build12.6.4-1ubuntu12.6.5-12.6.5-1ubuntu0.1~esm42.6.5-1ubuntu0.1~esm52.6.5-1ubuntu0.1~esm62.6.5-1ubuntu0.1~esm7
 None known
slurm-llnl
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
14.11.8-415.08.4-1build115.08.4-1build215.08.7-115.08.7-1build1
Show 4 moreShow less
15.08.7-1ubuntu0.1~esm315.08.7-1ubuntu0.1~esm415.08.7-1ubuntu0.1~esm515.08.7-1ubuntu0.1~esm6
 None known
slurm-llnl
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
17.02.6-1build117.02.9-117.11.2-1build117.11.2-1ubuntu0.1~esm317.11.2-1ubuntu0.1~esm417.11.2-1ubuntu0.1~esm5
 None known
slurm-llnl
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
19.05.3.2-219.05.3.2-2build119.05.5-119.05.5-1ubuntu0.1~esm119.05.5-1ubuntu0.1~esm2
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-49935 is a high vulnerability (CVSS 8.8) in Schedmd Slurm, published December 14, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.04%, the 64th percentile. Fixed in slurm-wlm 23.11.3-1.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open