libnss_slurm2-24.05.4-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:14450-1 Final 1 1 2024-11-01T00:00:00Z current 2024-11-01T00:00:00Z 2024-11-01T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z libnss_slurm2-24.05.4-1.1 on GA media These are all security issues fixed in the libnss_slurm2-24.05.4-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-14450 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WTMVOL54NWHN7TSPGSMNKSL634MRDD6M/ E-Mail link for openSUSE-SU-2024:14450-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2024-48936/ SUSE CVE CVE-2024-48936 page openSUSE Tumbleweed libnss_slurm2-24.05.4-1.1 libpmi0-24.05.4-1.1 libslurm41-24.05.4-1.1 perl-slurm-24.05.4-1.1 slurm-24.05.4-1.1 slurm-auth-none-24.05.4-1.1 slurm-config-24.05.4-1.1 slurm-config-man-24.05.4-1.1 slurm-cray-24.05.4-1.1 slurm-devel-24.05.4-1.1 slurm-doc-24.05.4-1.1 slurm-hdf5-24.05.4-1.1 slurm-lua-24.05.4-1.1 slurm-munge-24.05.4-1.1 slurm-node-24.05.4-1.1 slurm-openlava-24.05.4-1.1 slurm-pam_slurm-24.05.4-1.1 slurm-plugins-24.05.4-1.1 slurm-rest-24.05.4-1.1 slurm-seff-24.05.4-1.1 slurm-sjstat-24.05.4-1.1 slurm-slurmdbd-24.05.4-1.1 slurm-sql-24.05.4-1.1 slurm-sview-24.05.4-1.1 slurm-testsuite-24.05.4-1.1 slurm-torque-24.05.4-1.1 slurm-webdoc-24.05.4-1.1 libnss_slurm2-24.05.4-1.1 as a component of openSUSE Tumbleweed libpmi0-24.05.4-1.1 as a component of openSUSE Tumbleweed libslurm41-24.05.4-1.1 as a component of openSUSE Tumbleweed perl-slurm-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-auth-none-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-config-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-config-man-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-cray-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-devel-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-doc-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-hdf5-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-lua-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-munge-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-node-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-openlava-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-pam_slurm-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-plugins-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-rest-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-seff-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-sjstat-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-slurmdbd-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-sql-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-sview-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-testsuite-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-torque-24.05.4-1.1 as a component of openSUSE Tumbleweed slurm-webdoc-24.05.4-1.1 as a component of openSUSE Tumbleweed SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under other users' jobs. This is limited to jobs explicitly running with --stepmgr, or on systems that have globally enabled stepmgr via SlurmctldParameters=enable_stepmgr in their configuration. CVE-2024-48936 openSUSE Tumbleweed:libnss_slurm2-24.05.4-1.1 openSUSE Tumbleweed:libpmi0-24.05.4-1.1 openSUSE Tumbleweed:libslurm41-24.05.4-1.1 openSUSE Tumbleweed:perl-slurm-24.05.4-1.1 openSUSE Tumbleweed:slurm-24.05.4-1.1 openSUSE Tumbleweed:slurm-auth-none-24.05.4-1.1 openSUSE Tumbleweed:slurm-config-24.05.4-1.1 openSUSE Tumbleweed:slurm-config-man-24.05.4-1.1 openSUSE Tumbleweed:slurm-cray-24.05.4-1.1 openSUSE Tumbleweed:slurm-devel-24.05.4-1.1 openSUSE Tumbleweed:slurm-doc-24.05.4-1.1 openSUSE Tumbleweed:slurm-hdf5-24.05.4-1.1 openSUSE Tumbleweed:slurm-lua-24.05.4-1.1 openSUSE Tumbleweed:slurm-munge-24.05.4-1.1 openSUSE Tumbleweed:slurm-node-24.05.4-1.1 openSUSE Tumbleweed:slurm-openlava-24.05.4-1.1 openSUSE Tumbleweed:slurm-pam_slurm-24.05.4-1.1 openSUSE Tumbleweed:slurm-plugins-24.05.4-1.1 openSUSE Tumbleweed:slurm-rest-24.05.4-1.1 openSUSE Tumbleweed:slurm-seff-24.05.4-1.1 openSUSE Tumbleweed:slurm-sjstat-24.05.4-1.1 openSUSE Tumbleweed:slurm-slurmdbd-24.05.4-1.1 openSUSE Tumbleweed:slurm-sql-24.05.4-1.1 openSUSE Tumbleweed:slurm-sview-24.05.4-1.1 openSUSE Tumbleweed:slurm-testsuite-24.05.4-1.1 openSUSE Tumbleweed:slurm-torque-24.05.4-1.1 openSUSE Tumbleweed:slurm-webdoc-24.05.4-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WTMVOL54NWHN7TSPGSMNKSL634MRDD6M/ https://www.suse.com/security/cve/CVE-2024-48936.html CVE-2024-48936 https://bugzilla.suse.com/1236722 SUSE Bug 1236722