CVE catalog

CVE-2023-49935

slurm-wlm: CVE-2023-49935

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.04% · Oct 25, 2026

An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianslurm-wlmsid26.05.5-1fixed
Debianslurm-wlmforky26.05.5-1fixed
Debianslurm-wlmtrixie24.11.5-4fixed
Debianslurm-wlmtrixie-security24.11.5-4+deb13u1fixed
Debianslurm-wlmbookworm22.05.8-4+deb12u3not affected
Debianslurm-wlmbookworm-security22.05.8-4+deb12u3not affected
Ubuntuslurm-llnlpro19.05.3.2-2vulnerable
Ubuntuslurm-llnlpro19.05.3.2-2build1vulnerable
Ubuntuslurm-llnlpro19.05.5-1vulnerable
Ubuntuslurm-llnlpro19.05.5-1ubuntu0.1~esm1vulnerable
Ubuntuslurm-llnlpro19.05.5-1ubuntu0.1~esm2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianslurm-wlmsourcesid23.11.3-1not yet assignedNot reported[1058720]
Debianslurm-wlmsourceforky23.11.3-1not yet assignedNot reported[1058720]
Debianslurm-wlmsourcetrixie23.11.3-1not yet assignedNot reported[1058720]
Debianslurm-wlmsourcebookwormNot affectedunimportantNot reported[1058720]

[Debian bug #1058720]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]