{"id":"CVE-2023-49936","aliases":["DEBIAN-CVE-2023-49936","DSA-5609-1","EUVD-2023-53831","GHSA-pm82-478g-gq88","SUSE-SU-2024:0278-1","SUSE-SU-2024:0279-1","SUSE-SU-2024:0280-1","SUSE-SU-2024:0283-1","SUSE-SU-2024:0284-1","SUSE-SU-2024:0286-1","SUSE-SU-2024:0287-1","SUSE-SU-2024:0288-1","SUSE-SU-2024:0289-1","SUSE-SU-2024:0309-1","SUSE-SU-2024:0310-1","SUSE-SU-2024:0311-1","SUSE-SU-2024:0312-1","SUSE-SU-2024:0313-1","SUSE-SU-2024:0314-1","SUSE-SU-2024:0315-1","UBUNTU-CVE-2023-49936","openSUSE-SU-2024:13559-1"],"status":"published","title":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer...","description":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer dereference leads to denial of service. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0111,"percentile":0.66186,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2023-12-14T00:00:00Z","modified":"2026-10-28T02:31:10Z","fixes":[{"ecosystem":"Debian:12","package":"slurm-wlm","fixed_in":["22.05.8-4+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"slurm-wlm","fixed_in":["23.11.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"slurm-wlm","fixed_in":["23.11.3-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"slurm-wlm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.05.8-4+deb12u2"}]}],"versions":["22.05.8-4","22.05.8-4+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"slurm-wlm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.11.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"slurm-wlm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.11.3-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"slurm-wlm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.05.8-4+deb12u2"}]}],"versions":["22.05.8-4","22.05.8-4+deb12u1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"slurm_20_02","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.02.7-150100.3.30.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.9-150300.4.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"slurm_23_02","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.7-150300.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"slurm_23_02","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.7-150300.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"slurm_23_02","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.7-150300.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"slurm_22_05","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.05.11-150300.7.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"slurm_22_05","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.05.11-150300.7.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"slurm_22_05","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.05.11-150300.7.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"slurm_22_05","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.05.11-150300.7.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP5","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.7-150500.5.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.7-150500.5.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.7-150500.5.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"slurm_22_05","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.05.11-150200.5.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.02.7-150200.3.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"slurm_20_11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.9-150200.6.16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"slurm_20_11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.9-150200.6.16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"slurm_23_02","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.7-150200.5.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"slurm_20_11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.9-3.19.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"slurm_20_02","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.02.7-3.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"slurm_22_05","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.05.11-3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"slurm_23_02","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.02.7-3.16.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"slurm_18_08","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.08.9-3.23.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.9-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.9-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.11.9-150400.3.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for HPC 12","package":"slurm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.02.11-6.59.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"slurm-llnl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.7-1","2.5.7-1build1","2.6.4-1ubuntu1","2.6.5-1","2.6.5-1ubuntu0.1~esm4","2.6.5-1ubuntu0.1~esm5","2.6.5-1ubuntu0.1~esm6","2.6.5-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"slurm-llnl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["14.11.8-4","15.08.4-1build1","15.08.4-1build2","15.08.7-1","15.08.7-1build1","15.08.7-1ubuntu0.1~esm3","15.08.7-1ubuntu0.1~esm4","15.08.7-1ubuntu0.1~esm5","15.08.7-1ubuntu0.1~esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"slurm-llnl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.02.6-1build1","17.02.9-1","17.11.2-1build1","17.11.2-1ubuntu0.1~esm3","17.11.2-1ubuntu0.1~esm4","17.11.2-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"slurm-llnl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["19.05.3.2-2","19.05.3.2-2build1","19.05.5-1","19.05.5-1ubuntu0.1~esm1","19.05.5-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"slurm-wlm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["24.11.3-2","24.11.5-1","24.11.5-2","24.11.5-3","24.11.5-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"slurm-wlm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.11.2-1ubuntu2","26.05.4-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"slurm-wlm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["24.11.5-4","25.05.4-1","25.05.4-2","25.11.2-1ubuntu2"]}],"products":[{"vendor":"schedmd","product":"slurm"}],"references":[{"url":"https://www.schedmd.com/security-archive.php","tags":["x_transferred","Vendor Advisory","web","report"]},{"url":"https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html","tags":["x_transferred","Mailing List","Vendor Advisory","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49936","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO"},{"url":"https://github.com/advisories/GHSA-pm82-478g-gq88"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49936.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-49936","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240278-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216869","tags":["report"]},{"url":"https://bugzilla.suse.com/1218046","tags":["report"]},{"url":"https://bugzilla.suse.com/1218050","tags":["report"]},{"url":"https://bugzilla.suse.com/1218051","tags":["report"]},{"url":"https://bugzilla.suse.com/1218053","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49938","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240279-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216207","tags":["report"]},{"url":"https://bugzilla.suse.com/1217711","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41914","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240280-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218049","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49935","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240283-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240284-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240286-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240287-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240288-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240289-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240309-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240310-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240311-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240312-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240313-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240314-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208810","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240315-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-49936","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49936","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-49936","description":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer dereference leads to denial of service. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.","status":"published","published":"2023-12-14T00:00:00Z","modified":"2025-11-04T18:20:11.47Z","updated_at":"2026-11-02T14:35:12.998024Z"}],"euvd":[{"id":"EUVD-2023-53831","description":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer dereference leads to denial of service. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.","status":"published","published":"2023-12-14T00:00:00Z","modified":"2025-11-04T18:20:11Z","updated_at":"2026-11-02T19:49:24.151242Z"}],"ghsa":[{"id":"GHSA-pm82-478g-gq88","title":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer...","description":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer dereference leads to denial of service. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.","status":"published","published":"2023-12-14T06:30:44Z","modified":"2025-11-04T21:31:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:04:38.133233Z"}],"nvd":[{"id":"CVE-2023-49936","description":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer dereference leads to denial of service. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.","status":"published","published":"2023-12-14T05:15:10.98Z","modified":"2026-06-17T06:36:44.387Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:08:54.696438Z"}],"osv":[{"id":"DEBIAN-CVE-2023-49936","description":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer dereference leads to denial of service. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.","status":"published","published":"2023-12-14T05:15:10.98Z","modified":"2026-10-26T18:02:27.687532694Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"UBUNTU-CVE-2023-49936","description":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer dereference leads to denial of service. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.","status":"published","published":"2023-12-14T05:15:00Z","modified":"2026-10-17T12:56:43.001041682Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"CVE-2023-49936","description":"An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer dereference leads to denial of service. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.","status":"published","published":"2023-12-14T00:00:00Z","modified":"2026-10-28T02:31:10.249850172Z","updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"DSA-5609-1","title":"slurm-wlm - security update","status":"published","published":"2024-01-28T00:00:00Z","modified":"2026-03-09T02:11:13.046944Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2024:13559-1","title":"libnss_slurm2-23.02.7-1.1 on GA media","description":"These are all security issues fixed in the libnss_slurm2-23.02.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:07:26.095454Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2024:0278-1","title":"Security update for slurm_20_02","description":"This update for slurm_20_02 fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T06:15:30Z","modified":"2026-02-04T02:58:20.275317Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0279-1","title":"Security update for slurm","description":"This update for slurm fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207)\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T07:33:29Z","modified":"2026-02-04T03:59:54.831719Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0280-1","title":"Security update for slurm_23_02","description":"This update for slurm_23_02 fixes the following issues:\n\nUpdate to slurm 23.02.6:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T07:33:39Z","modified":"2026-02-04T03:17:26.106228Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0283-1","title":"Security update for slurm_22_05","description":"This update for slurm_22_05 fixes the following issues:\n\nUpdate to slurm 22.05.11:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T10:03:32Z","modified":"2025-05-02T04:35:44.855139Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0284-1","title":"Security update for slurm","description":"This update for slurm fixes the following issues:\n\nUpdate to slurm 23.02.6:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T10:03:48Z","modified":"2026-02-04T03:31:20.598373Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0286-1","title":"Security update for slurm_22_05","description":"This update for slurm_22_05 fixes the following issues:\n\nUpdate to slurm 22.05.11:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T11:03:28Z","modified":"2026-02-04T02:41:13.661721Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0287-1","title":"Security update for slurm","description":"This update for slurm fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T11:03:38Z","modified":"2026-02-04T02:49:42.137977Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0288-1","title":"Security update for slurm_20_11","description":"This update for slurm_20_11 fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207)\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T11:03:44Z","modified":"2025-05-02T04:35:25.538554Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0289-1","title":"Security update for slurm_23_02","description":"This update for slurm_23_02 fixes the following issues:\n\nUpdate to slurm 23.02.6:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-01-31T11:03:53Z","modified":"2026-02-04T03:32:18.428778Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0309-1","title":"Security update for slurm_20_11","description":"This update for slurm_20_11 fixes the following issues:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-02-02T05:03:27Z","modified":"2026-02-04T02:48:00.430283Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0310-1","title":"Security update for slurm_20_02","description":"This update for slurm_20_02 fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-02-02T05:03:33Z","modified":"2026-02-04T03:20:56.489102Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0311-1","title":"Security update for slurm_22_05","description":"This update for slurm_22_05 fixes the following issues:\n\nUpdate to slurm 22.05.11:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-02-02T05:03:38Z","modified":"2026-02-04T02:27:34.937784Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0312-1","title":"Security update for slurm_23_02","description":"This update for slurm_23_02 fixes the following issues:\n\nUpdate to slurm 23.02.6:\n\nSecurity fixes:\n\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-02-02T05:03:43Z","modified":"2026-02-04T02:52:24.912773Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0313-1","title":"Security update for slurm_18_08","description":"This update for slurm_18_08 fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207)\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Fix slurm upgrading to incompatible versions (bsc#1216869).    \n","status":"published","published":"2024-02-02T05:03:48Z","modified":"2026-02-04T02:51:53.582318Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0314-1","title":"Security update for slurm","description":"This update for slurm fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207)\n- CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)\n- CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)\n- CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)\n- CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053)\n\nOther fixes:\n\n- Add missing service file for slurmrestd (bsc#1217711).\n- Fix slurm upgrading to incompatible versions (bsc#1216869).\n","status":"published","published":"2024-02-02T08:13:26Z","modified":"2026-02-04T03:02:51.834542Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:0315-1","title":"Security update for slurm","description":"This update for slurm fixes the following issues:\n\n- CVE-2023-49933: Fixed a message extension attack that could bypass\n  the message hash (bsc#1218046).\n- CVE-2023-49936: Fixed a NULL pointer dereference (bsc#1218050).\n- CVE-2023-49937: Fixed a double free that could lead to denial of\n  service or code execution (bsc#1218051).\n- CVE-2023-49938: Fixed an incorrect access control issue that could\n  allow an attacker to modify their extended group list (bsc#1218053).\n","status":"published","published":"2024-02-02T08:55:34Z","modified":"2026-02-04T04:30:33.603915Z","updated_at":"2026-11-02T15:53:54.239786Z"}]}}