CVE-2023-49933

2023-12-1405:15:08

CWE-924

[email protected]

web.nvd.nist.gov

schedmd slurm

communication channel

integrity issue

fixed version

cve-2023-49933

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

22.7%

JSON

An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.

Affected configurations

Nvd

Node

schedmdslurmRange22.05–22.05.12

schedmdslurmRange23.02–23.02.7

schedmdslurmMatch23.11-

schedmdslurmMatch23.11rc1

VendorProductVersionCPE
schedmdslurm*cpe:2.3:a:schedmd:slurm:*:*:*:*:*:*:*:*
schedmdslurm23.11cpe:2.3:a:schedmd:slurm:23.11:-:*:*:*:*:*:*
schedmdslurm23.11cpe:2.3:a:schedmd:slurm:23.11:rc1:*:*:*:*:*:*

Vendor	Product	Version	CPE
schedmd	slurm	*	cpe:2.3:a:schedmd:slurm::::::::
schedmd	slurm	23.11	cpe:2.3:a:schedmd:slurm:23.11:-::::::
schedmd	slurm	23.11	cpe:2.3:a:schedmd:slurm:23.11:rc1::::::