SUSE-SU-2024:0289-1: slurm_23_02&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise

Published

Published 31-01-2024Last modified 04-02-2026

Vulnerability summary

SUSE-SU-2024:0289-1 is a vulnerability in slurm_23_02&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise with no CVSS score yet.

Overall risk

0/100

0100

Minimal · default modelHow is this calculated?

CVSS score

Not scored

010

No CVSS score recorded

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 5 · Downstream 0 · Related 5

CVE-2023-49933 CVE-2023-49935 CVE-2023-49936 CVE-2023-49937 CVE-2023-49938

Timeline

31-01-2024
PublishedVulnerability first disclosed.
04-02-2026
Last modifiedVulnerability information updated.

Description

Security update for slurm_23_02 This update for slurm_23_02 fixes the following issues: Update to slurm 23.02.6: Security fixes: - CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046) - CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049) - CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050) - CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051) - CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions. (bsc#1218053) Other fixes: - Add missing service file for slurmrestd (bsc#1217711). - Fix slurm upgrading to incompatible versions (bsc#1216869).