{"id":"UBUNTU-CVE-2024-48936","details":"SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under other users' jobs. This is limited to jobs explicitly running with --stepmgr, or on systems that have globally enabled stepmgr via SlurmctldParameters=enable_stepmgr in their configuration.","modified":"2026-05-07T13:31:06.701841Z","published":"2024-10-28T04:15:00Z","withdrawn":"2026-05-07T12:17:44Z","upstream":["CVE-2024-48936"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-48936"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2024-48936"},{"type":"REPORT","url":"https://www.schedmd.com/slurm-version-24-05-4-is-now-available/"}],"affected":[{"package":{"name":"slurm-wlm","ecosystem":"Ubuntu:Pro:22.04:LTS","purl":"pkg:deb/ubuntu/slurm-wlm@21.08.5-2ubuntu1+esm1?arch=source&distro=esm-apps/jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.11.7+really20.11.4-2","21.08.5-1","21.08.5-1.1","21.08.5-2","21.08.5-2ubuntu1","21.08.5-2ubuntu1+esm1"],"ecosystem_specific":{"binaries":[{"binary_name":"libpam-slurm","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"libpam-slurm-adopt","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"libpmi0","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"libpmi2-0","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"libslurm-perl","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"libslurm37","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"libslurmdb-perl","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"slurm-client","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"slurm-client-emulator","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"slurm-wlm","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"slurm-wlm-basic-plugins","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"slurm-wlm-emulator","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"slurm-wlm-torque","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"slurmctld","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"slurmd","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"slurmdbd","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"slurmrestd","binary_version":"21.08.5-2ubuntu1+esm1"},{"binary_name":"sview","binary_version":"21.08.5-2ubuntu1+esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-48936.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"Ubuntu","score":"medium"}]}