CVE-2023-49933

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.

Se descubrió un problema en SchedMD Slurm 22.05.x, 23.02.x y 23.11.x. Existe una aplicación inadecuada de la integridad del mensaje durante la transmisión en un canal de comunicación. Esto permite a los atacantes modificar el tráfico RPC de manera que eluda las comprobaciones de hash de mensajes. Las versiones fijas son 22.05.11, 23.02.7 y 23.11.1.

*Credits: N/A

CVSS Scores

NISTv3.1 7.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2023-12-03 CVE Reserved
2023-12-14 CVE Published
2024-08-02 CVE Updated
2024-11-13 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

CAPEC

References (4)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ	2024-01-03
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO	2024-01-03
https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html	2024-01-03
https://www.schedmd.com/security-archive.php	2024-01-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Schedmd Search vendor "Schedmd"		Slurm Search vendor "Schedmd" for product "Slurm"				>= 22.05 < 22.05.12 Search vendor "Schedmd" for product "Slurm" and version " >= 22.05 < 22.05.12"		-		Affected
Schedmd Search vendor "Schedmd"		Slurm Search vendor "Schedmd" for product "Slurm"				>= 23.02 < 23.02.7 Search vendor "Schedmd" for product "Slurm" and version " >= 23.02 < 23.02.7"		-		Affected
Schedmd Search vendor "Schedmd"		Slurm Search vendor "Schedmd" for product "Slurm"				23.11 Search vendor "Schedmd" for product "Slurm" and version "23.11"		-		Affected
Schedmd Search vendor "Schedmd"		Slurm Search vendor "Schedmd" for product "Slurm"				23.11 Search vendor "Schedmd" for product "Slurm" and version "23.11"		rc1		Affected