SUSE-SU-2024:0288-1: Security update for slurm_20_11
This update for slurm2011 fixes the following issues: Security fixes: CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207) CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046) CVE-2023-49936: Prevent NULL pointer dereference on sizevalp overflow. (bsc#1218050) CVE-2023-49937: Prevent double-xfree() on error in unpacknoderegresp(). (bsc#1218051) CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053) Other fixes: Add missing service file for slurmrestd (bsc#1217711). Fix slurm upgrading to incompatible versions (bsc#1216869).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/libslurm36-debuginfoto a version that resolves this vulnerability.Fixed in 20.11.9-150200.6.16.1 - Upgrade
Upgrade
suse/libslurm36to a version that resolves this vulnerability.Fixed in 20.11.9-150200.6.16.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-288=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2024-288=1
Event History
Child vulnerabilities
Contains the following vulnerabilities.