Skip to content
Fencer Vulns
high 8.2

CVE-2023-49938 json

An issue was discovered in SchedMD Slurm 22.05.x and 23.02.x.

published 2023-12-14 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-53833

cvss
8.2
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known

Summary

An issue was discovered in SchedMD Slurm 22.05.x and 23.02.x. There is Incorrect Access Control: an attacker can modified their extended group list that is used with the sbcast subsystem, and open files with an unauthorized set of extended groups. The fixed versions are 22.05.11 and 23.02.7.

Patch / fix

  • schedmd slurm 22.05.11, 23.02.7
  • slurm-wlm Debian 12 22.05.8-4+deb12u2
  • slurm-wlm Debian 14, Debian 13 23.11.3-1

debian advisories DEBIAN-CVE-2023-49938

  • slurm-wlm Ubuntu Pro 22.04 LTS 21.08.5-2ubuntu1+esm2

ubuntu advisories UBUNTU-CVE-2023-49938

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • slurm SLE Module for HPC 12 17.02.11-6.59.1
  • slurm SLE Module for Package Hub 15 SP5, SLE High Performance Computing 15 SP4-LTSS, SLE High Performance Computing 15 SP4-ESPOS 20.11.9-150400.3.3.1
  • slurm_18_08 SLE Module for HPC 12 18.08.9-3.23.1
  • slurm_23_02 SLE Module for HPC 12 23.02.7-3.16.1
  • slurm_22_05 SLE Module for HPC 12 22.05.11-3.9.1
  • slurm_20_02 SLE Module for HPC 12 20.02.7-3.20.1
  • slurm_20_11 SLE Module for HPC 12 20.11.9-3.19.1
  • slurm_20_11 SLE High Performance Computing 15 SP2-LTSS, openSUSE Leap 15.5 20.11.9-150200.6.16.1

suse advisories SUSE-SU-2024:0315-1SUSE-SU-2024:0314-1SUSE-SU-2024:0313-1SUSE-SU-2024:0312-1SUSE-SU-2024:0311-1SUSE-SU-2024:0310-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-49938 updated

slurm: incorrect access control

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.75% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.