What’s Vulnerable › Vulnerabilities

CVE-2023-49933

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-12-14 · updated 2026-06-17
• Weakness: CWE-924

Description

An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.

Affected products

• SchedMD Slurm: from 22.05 before 22.05.12; from 23.02 before 23.02.7; 23.11, 23.11-rc1 — fixed in 22.05.12, 23.02.7

How to fix

Upgrade to a fixed version: SchedMD Slurm 22.05.12, 23.02.7. Check the vendor advisory for mitigations.

References

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/
• https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html
• https://www.schedmd.com/security-archive.php
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/
• https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html
• https://www.schedmd.com/security-archive.php

Get alerted when CVE-2023-49933 or the next vulnerability affects your stack