SUSE update for slurm_22_05



Risk High
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2023-49933
CVE-2023-49936
CVE-2023-49937
CVE-2023-49938
CWE-ID CWE-924
CWE-476
CWE-415
CWE-284
Exploitation vector Network
Public exploit N/A
Vulnerable software
 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing 15
Operating systems & Components / Operating system

slurm_22_05-webdoc
Operating systems & Components / Operating system package or component

slurm_22_05-doc
Operating systems & Components / Operating system package or component

slurm_22_05-config
Operating systems & Components / Operating system package or component

slurm_22_05-config-man
Operating systems & Components / Operating system package or component

libnss_slurm2_22_05-debuginfo
Operating systems & Components / Operating system package or component

slurm_22_05-debugsource
Operating systems & Components / Operating system package or component

slurm_22_05-munge
Operating systems & Components / Operating system package or component

slurm_22_05-torque
Operating systems & Components / Operating system package or component

perl-slurm_22_05
Operating systems & Components / Operating system package or component

slurm_22_05-devel
Operating systems & Components / Operating system package or component

slurm_22_05-auth-none
Operating systems & Components / Operating system package or component

libslurm38
Operating systems & Components / Operating system package or component

slurm_22_05-sql-debuginfo
Operating systems & Components / Operating system package or component

libnss_slurm2_22_05
Operating systems & Components / Operating system package or component

slurm_22_05-munge-debuginfo
Operating systems & Components / Operating system package or component

slurm_22_05-node-debuginfo
Operating systems & Components / Operating system package or component

slurm_22_05-torque-debuginfo
Operating systems & Components / Operating system package or component

slurm_22_05-rest-debuginfo
Operating systems & Components / Operating system package or component

slurm_22_05-node
Operating systems & Components / Operating system package or component

slurm_22_05-debuginfo
Operating systems & Components / Operating system package or component

slurm_22_05-pam_slurm-debuginfo
Operating systems & Components / Operating system package or component

slurm_22_05-slurmdbd
Operating systems & Components / Operating system package or component

slurm_22_05-sview-debuginfo
Operating systems & Components / Operating system package or component

libpmi0_22_05
Operating systems & Components / Operating system package or component

slurm_22_05-lua
Operating systems & Components / Operating system package or component

slurm_22_05
Operating systems & Components / Operating system package or component

slurm_22_05-plugins
Operating systems & Components / Operating system package or component

slurm_22_05-auth-none-debuginfo
Operating systems & Components / Operating system package or component

libslurm38-debuginfo
Operating systems & Components / Operating system package or component

slurm_22_05-sview
Operating systems & Components / Operating system package or component

slurm_22_05-rest
Operating systems & Components / Operating system package or component

slurm_22_05-pam_slurm
Operating systems & Components / Operating system package or component

perl-slurm_22_05-debuginfo
Operating systems & Components / Operating system package or component

libpmi0_22_05-debuginfo
Operating systems & Components / Operating system package or component

slurm_22_05-sql
Operating systems & Components / Operating system package or component

slurm_22_05-slurmdbd-debuginfo
Operating systems & Components / Operating system package or component

slurm_22_05-lua-debuginfo
Operating systems & Components / Operating system package or component

slurm_22_05-plugins-debuginfo
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Improper Enforcement of Message Integrity During Transmission in a Communication Channel

EUVDB-ID: #VU84782

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-49933

CWE-ID: CWE-924 - Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper integrity check. A remote attacker can perform MitM attack and modify RPC traffic.

Mitigation

Update the affected package slurm_22_05 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS: 15-SP2

SUSE Linux Enterprise High Performance Computing 15: SP2

slurm_22_05-webdoc: before 22.05.11-150200.5.9.1

slurm_22_05-doc: before 22.05.11-150200.5.9.1

slurm_22_05-config: before 22.05.11-150200.5.9.1

slurm_22_05-config-man: before 22.05.11-150200.5.9.1

libnss_slurm2_22_05-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-debugsource: before 22.05.11-150200.5.9.1

slurm_22_05-munge: before 22.05.11-150200.5.9.1

slurm_22_05-torque: before 22.05.11-150200.5.9.1

perl-slurm_22_05: before 22.05.11-150200.5.9.1

slurm_22_05-devel: before 22.05.11-150200.5.9.1

slurm_22_05-auth-none: before 22.05.11-150200.5.9.1

libslurm38: before 22.05.11-150200.5.9.1

slurm_22_05-sql-debuginfo: before 22.05.11-150200.5.9.1

libnss_slurm2_22_05: before 22.05.11-150200.5.9.1

slurm_22_05-munge-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-node-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-torque-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-rest-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-node: before 22.05.11-150200.5.9.1

slurm_22_05-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-pam_slurm-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-slurmdbd: before 22.05.11-150200.5.9.1

slurm_22_05-sview-debuginfo: before 22.05.11-150200.5.9.1

libpmi0_22_05: before 22.05.11-150200.5.9.1

slurm_22_05-lua: before 22.05.11-150200.5.9.1

slurm_22_05: before 22.05.11-150200.5.9.1

slurm_22_05-plugins: before 22.05.11-150200.5.9.1

slurm_22_05-auth-none-debuginfo: before 22.05.11-150200.5.9.1

libslurm38-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-sview: before 22.05.11-150200.5.9.1

slurm_22_05-rest: before 22.05.11-150200.5.9.1

slurm_22_05-pam_slurm: before 22.05.11-150200.5.9.1

perl-slurm_22_05-debuginfo: before 22.05.11-150200.5.9.1

libpmi0_22_05-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-sql: before 22.05.11-150200.5.9.1

slurm_22_05-slurmdbd-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-lua-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-plugins-debuginfo: before 22.05.11-150200.5.9.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2024/suse-su-20240286-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) NULL pointer dereference

EUVDB-ID: #VU84785

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-49936

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can send specially crafted data to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package slurm_22_05 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS: 15-SP2

SUSE Linux Enterprise High Performance Computing 15: SP2

slurm_22_05-webdoc: before 22.05.11-150200.5.9.1

slurm_22_05-doc: before 22.05.11-150200.5.9.1

slurm_22_05-config: before 22.05.11-150200.5.9.1

slurm_22_05-config-man: before 22.05.11-150200.5.9.1

libnss_slurm2_22_05-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-debugsource: before 22.05.11-150200.5.9.1

slurm_22_05-munge: before 22.05.11-150200.5.9.1

slurm_22_05-torque: before 22.05.11-150200.5.9.1

perl-slurm_22_05: before 22.05.11-150200.5.9.1

slurm_22_05-devel: before 22.05.11-150200.5.9.1

slurm_22_05-auth-none: before 22.05.11-150200.5.9.1

libslurm38: before 22.05.11-150200.5.9.1

slurm_22_05-sql-debuginfo: before 22.05.11-150200.5.9.1

libnss_slurm2_22_05: before 22.05.11-150200.5.9.1

slurm_22_05-munge-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-node-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-torque-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-rest-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-node: before 22.05.11-150200.5.9.1

slurm_22_05-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-pam_slurm-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-slurmdbd: before 22.05.11-150200.5.9.1

slurm_22_05-sview-debuginfo: before 22.05.11-150200.5.9.1

libpmi0_22_05: before 22.05.11-150200.5.9.1

slurm_22_05-lua: before 22.05.11-150200.5.9.1

slurm_22_05: before 22.05.11-150200.5.9.1

slurm_22_05-plugins: before 22.05.11-150200.5.9.1

slurm_22_05-auth-none-debuginfo: before 22.05.11-150200.5.9.1

libslurm38-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-sview: before 22.05.11-150200.5.9.1

slurm_22_05-rest: before 22.05.11-150200.5.9.1

slurm_22_05-pam_slurm: before 22.05.11-150200.5.9.1

perl-slurm_22_05-debuginfo: before 22.05.11-150200.5.9.1

libpmi0_22_05-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-sql: before 22.05.11-150200.5.9.1

slurm_22_05-slurmdbd-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-lua-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-plugins-debuginfo: before 22.05.11-150200.5.9.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2024/suse-su-20240286-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Double Free

EUVDB-ID: #VU84784

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2023-49937

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can send specially crafted data to the application, trigger double free error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package slurm_22_05 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS: 15-SP2

SUSE Linux Enterprise High Performance Computing 15: SP2

slurm_22_05-webdoc: before 22.05.11-150200.5.9.1

slurm_22_05-doc: before 22.05.11-150200.5.9.1

slurm_22_05-config: before 22.05.11-150200.5.9.1

slurm_22_05-config-man: before 22.05.11-150200.5.9.1

libnss_slurm2_22_05-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-debugsource: before 22.05.11-150200.5.9.1

slurm_22_05-munge: before 22.05.11-150200.5.9.1

slurm_22_05-torque: before 22.05.11-150200.5.9.1

perl-slurm_22_05: before 22.05.11-150200.5.9.1

slurm_22_05-devel: before 22.05.11-150200.5.9.1

slurm_22_05-auth-none: before 22.05.11-150200.5.9.1

libslurm38: before 22.05.11-150200.5.9.1

slurm_22_05-sql-debuginfo: before 22.05.11-150200.5.9.1

libnss_slurm2_22_05: before 22.05.11-150200.5.9.1

slurm_22_05-munge-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-node-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-torque-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-rest-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-node: before 22.05.11-150200.5.9.1

slurm_22_05-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-pam_slurm-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-slurmdbd: before 22.05.11-150200.5.9.1

slurm_22_05-sview-debuginfo: before 22.05.11-150200.5.9.1

libpmi0_22_05: before 22.05.11-150200.5.9.1

slurm_22_05-lua: before 22.05.11-150200.5.9.1

slurm_22_05: before 22.05.11-150200.5.9.1

slurm_22_05-plugins: before 22.05.11-150200.5.9.1

slurm_22_05-auth-none-debuginfo: before 22.05.11-150200.5.9.1

libslurm38-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-sview: before 22.05.11-150200.5.9.1

slurm_22_05-rest: before 22.05.11-150200.5.9.1

slurm_22_05-pam_slurm: before 22.05.11-150200.5.9.1

perl-slurm_22_05-debuginfo: before 22.05.11-150200.5.9.1

libpmi0_22_05-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-sql: before 22.05.11-150200.5.9.1

slurm_22_05-slurmdbd-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-lua-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-plugins-debuginfo: before 22.05.11-150200.5.9.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2024/suse-su-20240286-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper access control

EUVDB-ID: #VU84783

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-49938

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can modify extended group list that is used with the sbcast subsystem, and open files with an unauthorized set of extended groups

Mitigation

Update the affected package slurm_22_05 to the latest version.

Vulnerable software versions

SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS: 15-SP2

SUSE Linux Enterprise High Performance Computing 15: SP2

slurm_22_05-webdoc: before 22.05.11-150200.5.9.1

slurm_22_05-doc: before 22.05.11-150200.5.9.1

slurm_22_05-config: before 22.05.11-150200.5.9.1

slurm_22_05-config-man: before 22.05.11-150200.5.9.1

libnss_slurm2_22_05-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-debugsource: before 22.05.11-150200.5.9.1

slurm_22_05-munge: before 22.05.11-150200.5.9.1

slurm_22_05-torque: before 22.05.11-150200.5.9.1

perl-slurm_22_05: before 22.05.11-150200.5.9.1

slurm_22_05-devel: before 22.05.11-150200.5.9.1

slurm_22_05-auth-none: before 22.05.11-150200.5.9.1

libslurm38: before 22.05.11-150200.5.9.1

slurm_22_05-sql-debuginfo: before 22.05.11-150200.5.9.1

libnss_slurm2_22_05: before 22.05.11-150200.5.9.1

slurm_22_05-munge-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-node-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-torque-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-rest-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-node: before 22.05.11-150200.5.9.1

slurm_22_05-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-pam_slurm-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-slurmdbd: before 22.05.11-150200.5.9.1

slurm_22_05-sview-debuginfo: before 22.05.11-150200.5.9.1

libpmi0_22_05: before 22.05.11-150200.5.9.1

slurm_22_05-lua: before 22.05.11-150200.5.9.1

slurm_22_05: before 22.05.11-150200.5.9.1

slurm_22_05-plugins: before 22.05.11-150200.5.9.1

slurm_22_05-auth-none-debuginfo: before 22.05.11-150200.5.9.1

libslurm38-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-sview: before 22.05.11-150200.5.9.1

slurm_22_05-rest: before 22.05.11-150200.5.9.1

slurm_22_05-pam_slurm: before 22.05.11-150200.5.9.1

perl-slurm_22_05-debuginfo: before 22.05.11-150200.5.9.1

libpmi0_22_05-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-sql: before 22.05.11-150200.5.9.1

slurm_22_05-slurmdbd-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-lua-debuginfo: before 22.05.11-150200.5.9.1

slurm_22_05-plugins-debuginfo: before 22.05.11-150200.5.9.1

CPE2.3 External links

https://www.suse.com/support/update/announcement/2024/suse-su-20240286-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###