{"id":"CVE-2023-49933","aliases":["DEBIAN-CVE-2023-49933","DSA-5609-1","EUVD-2023-53828","GHSA-hgjx-j8hg-pxrf","SUSE-SU-2024:0278-1","SUSE-SU-2024:0279-1","SUSE-SU-2024:0280-1","SUSE-SU-2024:0283-1","SUSE-SU-2024:0284-1","SUSE-SU-2024:0286-1","SUSE-SU-2024:0287-1","SUSE-SU-2024:0288-1","SUSE-SU-2024:0289-1","SUSE-SU-2024:0309-1","SUSE-SU-2024:0310-1","SUSE-SU-2024:0311-1","SUSE-SU-2024:0312-1","SUSE-SU-2024:0313-1","SUSE-SU-2024:0314-1","SUSE-SU-2024:0315-1","UBUNTU-CVE-2023-49933","USN-8236-1","openSUSE-SU-2024:13559-1"],"status":"published","title":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper...","description":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00375,"percentile":0.31827,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-924"],"published":"2023-12-14T00:00:00Z","modified":"2026-10-28T02:30:59Z","fixes":[{"ecosystem":"Debian:12","package":"slurm-wlm","fixed_in":["22.05.8-4+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"slurm-wlm","fixed_in":["23.11.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"slurm-wlm","fixed_in":["23.11.3-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"slurm-wlm","fixed_in":["21.08.5-2ubuntu1+esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"slurm-wlm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.05.8-4+deb12u2"}]}],"versions":["22.05.8-4","22.05.8-4+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"slurm-wlm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.11.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"slurm-wlm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.11.3-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"slurm-wlm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.05.8-4+deb12u2"}]}],"versions":["22.05.8-4","22.05.8-4+deb12u1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"slurm_20_02","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.02.7-150100.3.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.9-150300.4.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"slurm_23_02","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.7-150300.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"slurm_23_02","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.7-150300.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"slurm_23_02","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.7-150300.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"slurm_22_05","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.05.11-150300.7.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"slurm_22_05","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.05.11-150300.7.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"slurm_22_05","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.05.11-150300.7.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"slurm_22_05","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.05.11-150300.7.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP5","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.7-150500.5.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.7-150500.5.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.7-150500.5.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"slurm_22_05","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.05.11-150200.5.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.02.7-150200.3.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"slurm_20_11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.9-150200.6.16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"slurm_20_11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.9-150200.6.16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"slurm_23_02","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.7-150200.5.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"slurm_20_11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.9-3.19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"slurm_20_02","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.02.7-3.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"slurm_22_05","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.05.11-3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"slurm_23_02","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.7-3.16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"slurm_18_08","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.08.9-3.23.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.9-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.9-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.9-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.02.11-6.59.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"slurm-llnl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.7-1","2.5.7-1build1","2.6.4-1ubuntu1","2.6.5-1","2.6.5-1ubuntu0.1~esm4","2.6.5-1ubuntu0.1~esm5","2.6.5-1ubuntu0.1~esm6","2.6.5-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"slurm-llnl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14.11.8-4","15.08.4-1build1","15.08.4-1build2","15.08.7-1","15.08.7-1build1","15.08.7-1ubuntu0.1~esm3","15.08.7-1ubuntu0.1~esm4","15.08.7-1ubuntu0.1~esm5","15.08.7-1ubuntu0.1~esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"slurm-llnl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.02.6-1build1","17.02.9-1","17.11.2-1build1","17.11.2-1ubuntu0.1~esm3","17.11.2-1ubuntu0.1~esm4","17.11.2-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"slurm-llnl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["19.05.3.2-2","19.05.3.2-2build1","19.05.5-1","19.05.5-1ubuntu0.1~esm1","19.05.5-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"slurm-wlm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.08.5-2ubuntu1+esm2"}]}],"versions":["20.11.7+really20.11.4-2","21.08.5-1","21.08.5-1.1","21.08.5-2","21.08.5-2ubuntu1","21.08.5-2ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"slurm-wlm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.08.5-2ubuntu1+esm2"}]}],"versions":["20.11.7+really20.11.4-2","21.08.5-1","21.08.5-1.1","21.08.5-2","21.08.5-2ubuntu1","21.08.5-2ubuntu1+esm1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"slurm-wlm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.11.4-1.2ubuntu5+esm1"}]}],"versions":["23.02.3-2ubuntu1","23.02.6-1ubuntu2","23.02.6-1ubuntu3","23.11.3-1ubuntu1","23.11.3-2ubuntu1","23.11.3-2ubuntu2","23.11.4-1.2ubuntu4","23.11.4-1.2ubuntu5"],"bundled":5}],"products":[{"vendor":"schedmd","product":"slurm"}],"references":[{"url":"https://www.schedmd.com/security-archive.php","tags":["x_transferred","Vendor Advisory","web","report"]},{"url":"https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html","tags":["x_transferred","Mailing List","Vendor Advisory","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49933","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ"},{"url":"https://github.com/advisories/GHSA-hgjx-j8hg-pxrf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49933.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-49933","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240278-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216869","tags":["report"]},{"url":"https://bugzilla.suse.com/1218046","tags":["report"]},{"url":"https://bugzilla.suse.com/1218050","tags":["report"]},{"url":"https://bugzilla.suse.com/1218051","tags":["report"]},{"url":"https://bugzilla.suse.com/1218053","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49938","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240279-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216207","tags":["report"]},{"url":"https://bugzilla.suse.com/1217711","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41914","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240280-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218049","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49935","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240283-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240284-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240286-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240287-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240288-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240289-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240309-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240310-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240311-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240312-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240313-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240314-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208810","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240315-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-49933","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49933","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8236-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-41914","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-49937","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-49938","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-43904","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-49933","description":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.","status":"published","published":"2023-12-14T00:00:00Z","modified":"2025-11-04T18:20:04.049Z","updated_at":"2026-11-02T14:35:13.368958Z"}],"euvd":[{"id":"EUVD-2023-53828","description":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.","status":"published","published":"2023-12-14T00:00:00Z","modified":"2025-11-04T18:20:04Z","updated_at":"2026-11-02T19:49:24.151242Z"}],"ghsa":[{"id":"GHSA-hgjx-j8hg-pxrf","title":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper...","description":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.","status":"published","published":"2023-12-14T06:30:44Z","modified":"2025-11-04T21:31:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-924"],"updated_at":"2026-11-02T15:04:38.133233Z"}],"nvd":[{"id":"CVE-2023-49933","description":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.","status":"published","published":"2023-12-14T05:15:08.81Z","modified":"2026-06-17T06:36:43.947Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-924"],"updated_at":"2026-11-02T14:08:54.696438Z"}],"osv":[{"id":"DEBIAN-CVE-2023-49933","description":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.","status":"published","published":"2023-12-14T05:15:08.81Z","modified":"2026-10-26T18:02:27.686279721Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"UBUNTU-CVE-2023-49933","description":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.","status":"published","published":"2023-12-14T05:15:00Z","modified":"2026-05-07T13:29:08.304016Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"CVE-2023-49933","description":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.","status":"published","published":"2023-12-14T00:00:00Z","modified":"2026-10-28T02:30:59.990207298Z","updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"DSA-5609-1","title":"slurm-wlm - security update","status":"published","published":"2024-01-28T00:00:00Z","modified":"2026-03-09T02:11:13.046944Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2024:13559-1","title":"libnss_slurm2-23.02.7-1.1 on GA media","description":"These are all security issues fixed in the libnss_slurm2-23.02.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:07:26.095454Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2024:0278-1","title":"Security update for slurm_20_02","description":"This update for slurm_20_02 fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T06:15:30Z","modified":"2026-02-04T02:58:20.275317Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0279-1","title":"Security update for slurm","description":"This update for slurm fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207)\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T07:33:29Z","modified":"2026-02-04T03:59:54.831719Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0280-1","title":"Security update for slurm_23_02","description":"This update for slurm_23_02 fixes the following issues:\n\nUpdate to slurm 23.02.6:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T07:33:39Z","modified":"2026-02-04T03:17:26.106228Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0283-1","title":"Security update for slurm_22_05","description":"This update for slurm_22_05 fixes the following issues:\n\nUpdate to slurm 22.05.11:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T10:03:32Z","modified":"2025-05-02T04:35:44.855139Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0284-1","title":"Security update for slurm","description":"This update for slurm fixes the following issues:\n\nUpdate to slurm 23.02.6:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T10:03:48Z","modified":"2026-02-04T03:31:20.598373Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0286-1","title":"Security update for slurm_22_05","description":"This update for slurm_22_05 fixes the following issues:\n\nUpdate to slurm 22.05.11:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T11:03:28Z","modified":"2026-02-04T02:41:13.661721Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0287-1","title":"Security update for slurm","description":"This update for slurm fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T11:03:38Z","modified":"2026-02-04T02:49:42.137977Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0288-1","title":"Security update for slurm_20_11","description":"This update for slurm_20_11 fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207)\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T11:03:44Z","modified":"2025-05-02T04:35:25.538554Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0289-1","title":"Security update for slurm_23_02","description":"This update for slurm_23_02 fixes the following issues:\n\nUpdate to slurm 23.02.6:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T11:03:53Z","modified":"2026-02-04T03:32:18.428778Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0309-1","title":"Security update for slurm_20_11","description":"This update for slurm_20_11 fixes the following issues:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-02-02T05:03:27Z","modified":"2026-02-04T02:48:00.430283Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0310-1","title":"Security update for slurm_20_02","description":"This update for slurm_20_02 fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-02-02T05:03:33Z","modified":"2026-02-04T03:20:56.489102Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0311-1","title":"Security update for slurm_22_05","description":"This update for slurm_22_05 fixes the following issues:\n\nUpdate to slurm 22.05.11:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-02-02T05:03:38Z","modified":"2026-02-04T02:27:34.937784Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0312-1","title":"Security update for slurm_23_02","description":"This update for slurm_23_02 fixes the following issues:\n\nUpdate to slurm 23.02.6:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-02-02T05:03:43Z","modified":"2026-02-04T02:52:24.912773Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0313-1","title":"Security update for slurm_18_08","description":"This update for slurm_18_08 fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207)\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Fix slurm upgrading to incompatible versions (bsc#1216869).    \n","status":"published","published":"2024-02-02T05:03:48Z","modified":"2026-02-04T02:51:53.582318Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0314-1","title":"Security update for slurm","description":"This update for slurm fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207)\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-02-02T08:13:26Z","modified":"2026-02-04T03:02:51.834542Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0315-1","title":"Security update for slurm","description":"This update for slurm fixes the following issues:\n\n- CVE-2023-49933: Fixed a message extension attack that could bypass\n  the message hash (bsc#1218046).\n- CVE-2023-49936: Fixed a NULL pointer dereference (bsc#1218050).\n- CVE-2023-49937: Fixed a double free that could lead to denial of\n  service or code execution (bsc#1218051).\n- CVE-2023-49938: Fixed an incorrect access control issue that could\n  allow an attacker to modify their extended group list (bsc#1218053).\n","status":"published","published":"2024-02-02T08:55:34Z","modified":"2026-02-04T04:30:33.603915Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"USN-8236-1","title":"slurm-wlm vulnerabilities","description":"It was discovered that Slurm did not correctly handle certain file system\noperations. An attacker could possibly use this issue to modify files or\nleak sensitive information. This issue only affected Ubuntu 22.04 LTS.\n(CVE-2023-41914)\n\nRyan Hall discovered that Slurm did not correctly enforce certain message\nintegrity checks. An attacker could possibly use this issue to bypass\nintegrity checks. This issue only affected Ubuntu 22.04 LTS.\n(CVE-2023-49933)\n\nRyan Hall discovered that Slurm did not correctly handle certain memory\noperations. An attacker could possibly use this issue to cause a denial of\nservice or execute arbitrary code. This issue only affected Ubuntu 22.04\nLTS. (CVE-2023-49937)\n\nRyan Hall discovered that Slurm did not correctly handle certain access\ncontrol mechanisms. An attacker could possibly use this issue to modify\nfiles or leak sensitive information. This issue only affected Ubuntu 22.04\nLTS. (CVE-2023-49938)\n\nIt was discovered that Slurm did not correctly handle user promotion. An\nattacker could possibly use this issue to promote themselves to an\nadministrator. (CVE-2025-43904)","status":"published","published":"2026-05-06T05:43:00Z","modified":"2026-05-08T12:33:13.607305049Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}