-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 07 Sep 2026 15:28:59 +0800 Source: slurm-wlm Architecture: source Version: 24.11.5-4+deb13u1 Distribution: trixie-security Urgency: high Maintainer: Debian HPC Team <debian-hpc@lists.debian.org> Changed-By: Aron Xu <aron@debian.org> Closes: 1146563 Changes: slurm-wlm (24.11.5-4+deb13u1) trixie-security; urgency=high . * Non-maintainer upload. * Fix multiple security issues by backporting the upstream fixes from the slurm-25.05 branch (Closes: #1146563): * CVE-2026-65107: sbcast shared objects skipped credential verification, and slurmd could crash on invalid sbcast filenames. * CVE-2026-65108: slurmstepd stack overflow when a job environment contains an oversized SPANK option variable. * CVE-2026-65109: slurmstepd could remove files outside the container spool directory when cleaning up an OCI container, and left spool directories behind when ContainerPath contains a task id pattern. * CVE-2026-65138: heap over-read and NULL pointer dereference in slurmd when unpacking a malformed forward data RPC. * CVE-2026-65139: slurmdbd used unsafe cluster names and non-numeric id lists in accounting database queries. * CVE-2026-65140: privilege escalation where an operator could alter Administrator accounts through the accounting database. * CVE-2026-65165: a job step using arbitrary distribution could end up with a node count disagreeing with its node list. The count is now taken from the list, hostlist functions are rejected in it, and a list that disagrees with the requested node count is refused. * Fix possible slurmstepd crash on step socket requests with invalid lengths. Checksums-Sha1: d8ae679f27861ab149aac3eb3721d1a1b099d594 5075 slurm-wlm_24.11.5-4+deb13u1.dsc ee73999cd33002a5275ceb56c90874abc281a327 9907599 slurm-wlm_24.11.5.orig.tar.gz eb8e11dc438e7b18260666a1ccbbc30acd3ca7ae 154864 slurm-wlm_24.11.5-4+deb13u1.debian.tar.xz 47a49950b8ef7e88e85145138bff18cf31a7aebe 6563 slurm-wlm_24.11.5-4+deb13u1_source.buildinfo Checksums-Sha256: 3cba9330f0f2d4189540558aba7f6ebb0d97f26fb5d8c1b4e90f1de7df1d9153 5075 slurm-wlm_24.11.5-4+deb13u1.dsc e1a5547edd212c38b5e3230a284133f777b32746551f094aaa81cc4af375e332 9907599 slurm-wlm_24.11.5.orig.tar.gz 978126ae878e975b81d1eb147eb4dd622431e05edd1a9ae45743d1f8e1790c14 154864 slurm-wlm_24.11.5-4+deb13u1.debian.tar.xz b47d2fdeb434e05e1b6fa767e5b6e5fd48d0c1a7860c14badea38ed68521c518 6563 slurm-wlm_24.11.5-4+deb13u1_source.buildinfo Files: 365fffdd2e775b394ef830120bf042aa 5075 admin optional slurm-wlm_24.11.5-4+deb13u1.dsc 4059b2f58afe4b9494be08b1f1195e4c 9907599 admin optional slurm-wlm_24.11.5.orig.tar.gz 83f512126cd75073413bf75694ffc059 154864 admin optional slurm-wlm_24.11.5-4+deb13u1.debian.tar.xz 811806ebccede14d338f093cba371285 6563 admin optional slurm-wlm_24.11.5-4+deb13u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqfuvEACgkQ+GQ1dHE8 m67L0Qf9G2/7ImaEo4MkfgKL49/fGiovM2ubpvUHx7EhpxjXgopUWM5QCe69eLEO hYoH7ZLZ1RD+01MdQKqyI4EuLTMGPw7Fv1zISzVdl6x8yBPoPj6NOUrZTZWicU55 Bb3TF4dPSb/zzoXo6hcES2+6SGJqmgWUS72TrjS4HqVeKPeGqJaXyuynsx2p6KR8 nkB+PJgbEBI86l2FUqYffZvYlEOj6dlSiy8O+PaFCAJmUguaEfHKAaWQ4nJX6a9P S5VeyHI/pO3yxEye4k9OtqtihZv0LCEJgaJ0xVi/qFIoANf0H/c9N1U1Zjt5A2gO NXSfQ7HOyRS433jzat4OBOk4lL13nQ== =Hjbk -----END PGP SIGNATURE-----
