Bug 2254495 (CVE-2023-49938) - CVE-2023-49938 slurm: incorrect access control
Summary: CVE-2023-49938 slurm: incorrect access control
Keywords:
Status: NEW
Alias: CVE-2023-49938
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2254496
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-12-14 09:20 UTC by ybuenos
Modified: 2023-12-14 09:20 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description ybuenos 2023-12-14 09:20:05 UTC 
An issue was discovered in SchedMD Slurm 22.05.x and 23.02.x. There is Incorrect Access Control: an attacker can modified their extended group list that is used with the sbcast subsystem, and open files with an unauthorized set of extended groups. The fixed versions are 22.05.11 and 23.02.7.

https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html
https://www.schedmd.com/security-archive.php
Comment 1 ybuenos 2023-12-14 09:20:17 UTC 
Created slurm tracking bugs for this issue:

Affects: fedora-all [bug 2254496]
Note You need to log in before you can comment on or make changes to this bug.