CVE-2023-49938: 
NixOS vulnerability analysis and mitigation

An issue was discovered in SchedMD Slurm versions 22.05.x and 23.02.x related to incorrect access control. The vulnerability was identified in December 2023, with fixed versions 22.05.11 and 23.02.7 released to address the issue (Slurm Announce, NVD).

The vulnerability allows an attacker to modify their extended group list that is used with the sbcast subsystem, and open files with an unauthorized set of extended groups. The vulnerability has been assigned a CVSS v3.1 base score of 8.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (NVD).

The vulnerability enables attackers to access files with incorrect group permissions, potentially leading to unauthorized access to sensitive data. This represents a significant security risk as it could allow attackers to bypass intended access control mechanisms (Slurm Announce).

There are no mitigations available for this issue; the only option is to patch and restart the affected daemons. Organizations should upgrade to the fixed versions (22.05.11 or 23.02.7) immediately. Due to the complexity of these fixes, SchedMD does not recommend attempting to back-port the fixes to older releases (Slurm Announce).