CVE-2023-49933

An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.

Weakness

The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.

Affected Software

Name	Vendor	Start Version	End Version
Slurm	Schedmd	22.05 (including)	22.05.12 (excluding)
Slurm	Schedmd	23.02 (including)	23.02.7 (excluding)
Slurm	Schedmd	23.11 (including)	23.11 (including)
Slurm	Schedmd	23.11-rc1 (including)	23.11-rc1 (including)
Slurm-llnl	Ubuntu	bionic	*
Slurm-llnl	Ubuntu	esm-apps/bionic	*
Slurm-llnl	Ubuntu	esm-apps/focal	*
Slurm-llnl	Ubuntu	esm-apps/xenial	*
Slurm-llnl	Ubuntu	esm-infra-legacy/trusty	*
Slurm-llnl	Ubuntu	focal	*
Slurm-llnl	Ubuntu	trusty	*
Slurm-llnl	Ubuntu	trusty/esm	*
Slurm-llnl	Ubuntu	xenial	*
Slurm-wlm	Ubuntu	bionic	*
Slurm-wlm	Ubuntu	esm-apps/jammy	*
Slurm-wlm	Ubuntu	jammy	*
Slurm-wlm	Ubuntu	lunar	*
Slurm-wlm	Ubuntu	mantic	*
Slurm-wlm	Ubuntu	oracular	*
Slurm-wlm	Ubuntu	trusty	*
Slurm-wlm	Ubuntu	xenial	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2023-49933
CWE	https://cwe.mitre.org/data/definitions/924.html

Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Weakness

Affected Software

References