CVE-2023-49938

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-49938
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-49938.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-49938
Related
Published
2023-12-14T05:15:11Z
Modified
2024-10-12T11:13:19.909158Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in SchedMD Slurm 22.05.x and 23.02.x. There is Incorrect Access Control: an attacker can modified their extended group list that is used with the sbcast subsystem, and open files with an unauthorized set of extended groups. The fixed versions are 22.05.11 and 23.02.7.

References

Affected packages

Debian:11 / slurm-wlm

Package

Name
slurm-wlm
Purl
pkg:deb/debian/slurm-wlm?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

20.*

20.11.7+really20.11.4-2
20.11.7+really20.11.4-2+deb11u1
20.11.8-1

21.*

21.08.5-1
21.08.5-1.1
21.08.5-2
21.08.6-1
21.08.7-1
21.08.8.2-1
21.08.8.2-1.1

22.*

22.05.7-1
22.05.7-2
22.05.8-1
22.05.8-2
22.05.8-3
22.05.8-4

23.*

23.02.3-1
23.02.3-2
23.02.5-1
23.02.6-1
23.02.6-1.1~exp1
23.11.3-1
23.11.3-2
23.11.3-2.1~exp1
23.11.3-2.1~exp2
23.11.4-1
23.11.4-1.1
23.11.4-1.2
23.11.4-1.3
23.11.4-1.4
23.11.4-2
23.11.6-1
23.11.7-1

24.*

24.05.1-1
24.05.1-2
24.05.2-1

Ecosystem specific 

{
    "urgency": "end-of-life"
}

Debian:12 / slurm-wlm

Package

Name
slurm-wlm
Purl
pkg:deb/debian/slurm-wlm?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
22.05.8-4+deb12u2

Affected versions

22.*

22.05.8-4
22.05.8-4+deb12u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / slurm-wlm

Package

Name
slurm-wlm
Purl
pkg:deb/debian/slurm-wlm?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
23.11.3-1

Affected versions

22.*

22.05.8-4

23.*

23.02.3-1
23.02.3-2
23.02.5-1
23.02.6-1
23.02.6-1.1~exp1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/schedmd/slurm

Affected ranges

Type
GIT
Repo
https://github.com/schedmd/slurm
Events
Introduced
04d4ec01c9aeccc9e352c721985b036b4d8126b9
Fixed
608e2f502ffe0decc5564cb51525ddfd4cc59efd

Affected versions

Other

slurm-22-05-0-1
slurm-22-05-1-1
slurm-22-05-10-1
slurm-22-05-2-1
slurm-22-05-3-1
slurm-22-05-4-1
slurm-22-05-5-1
slurm-22-05-6-1
slurm-22-05-7-1
slurm-22-05-8-1
slurm-22-05-9-1