An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x.

published 2023-12-14 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-53828

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 31%
public exploits: 0; none known

An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.

Patch / fix

fixed in 1 distros 3

schedmd slurm 22.05.12, 23.02.7

debian ubuntu suse

slurm-wlm Debian 12 22.05.8-4+deb12u2
slurm-wlm Debian 14, Debian 13 23.11.3-1

debian advisories DEBIAN-CVE-2023-49933

slurm-wlm Ubuntu Pro 22.04 LTS 21.08.5-2ubuntu1+esm2

ubuntu advisories UBUNTU-CVE-2023-49933

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

slurm SLE Module for HPC 12 17.02.11-6.59.1
slurm SLE Module for Package Hub 15 SP5, SLE High Performance Computing 15 SP4-LTSS, SLE High Performance Computing 15 SP4-ESPOS 20.11.9-150400.3.3.1
slurm_18_08 SLE Module for HPC 12 18.08.9-3.23.1
slurm_23_02 SLE Module for HPC 12 23.02.7-3.16.1
slurm_22_05 SLE Module for HPC 12 22.05.11-3.9.1
slurm_20_02 SLE Module for HPC 12 20.02.7-3.20.1
slurm_20_11 SLE Module for HPC 12 20.11.9-3.19.1
slurm_20_11 SLE High Performance Computing 15 SP2-LTSS, openSUSE Leap 15.5 20.11.9-150200.6.16.1

suse advisories SUSE-SU-2024:0315-1 SUSE-SU-2024:0314-1 SUSE-SU-2024:0313-1 SUSE-SU-2024:0312-1 SUSE-SU-2024:0311-1 SUSE-SU-2024:0310-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-49933 updated 2026-01-13

slurm: Improper Enforcement of Message Integrity

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Classification

Weakness

CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel

References

lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/
vendor-advisory
schedmd.com /security-archive.php
vendor-advisory
lists.schedmd.com /pipermail/slurm-announce/2023/000103.html
mailing-list, vendor-advisory
lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/

Sources

CVE List CVE-2023-49933
NVD CVE-2023-49933

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary