Your message dated Sun, 06 Sep 2026 22:35:10 +0000
with message-id <[email protected]>
and subject line Bug#1146563: fixed in slurm-wlm 26.05.4-1
has caused the Debian Bug report #1146563,
regarding slurm-wlm: CVE-2026-65107 CVE-2026-65108 CVE-2026-65109
CVE-2026-65138 CVE-2026-65139 CVE-2026-65140 CVE-2026-65165
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146563: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146563
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: slurm-wlm
Version: 26.05.3-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for slurm-wlm.
CVE-2026-65107[0]:
| Fix sbcast shared objects skipping credential verification, Fix
| possible slurmd crash on invalid sbcast filenames
CVE-2026-65108[1]:
| Fix a slurmstepd stack overflow when a job environment contains an
| oversized SPANK option variable
CVE-2026-65109[2]:
| Fix slurmstepd removing files outside the container spool directory
| when cleaning up an OCI containe, Fix slurmstepd leaving OCI container
| spool directories behind when ContainerPath contains a task id pattern
CVE-2026-65138[3]:
| Fix heap over-read when unpacking a malformed forward data RPC in
| slurmd. Fix a slurmd crash when handling a malformed forward data RPC
| with a missing socket address
CVE-2026-65139[4]:
| Fix various issues in unsafe operation/queries to the slurmdbd
CVE-2026-65140[5]:
| Fix a privilege escalation where an operator could alter Administrator
| accounts through the accounting database
CVE-2026-65165[6]:
| Fix various issues around job steps and node count discrepancies
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-65107
https://www.cve.org/CVERecord?id=CVE-2026-65107
[1] https://security-tracker.debian.org/tracker/CVE-2026-65108
https://www.cve.org/CVERecord?id=CVE-2026-65108
[2] https://security-tracker.debian.org/tracker/CVE-2026-65109
https://www.cve.org/CVERecord?id=CVE-2026-65109
[3] https://security-tracker.debian.org/tracker/CVE-2026-65138
https://www.cve.org/CVERecord?id=CVE-2026-65138
[4] https://security-tracker.debian.org/tracker/CVE-2026-65139
https://www.cve.org/CVERecord?id=CVE-2026-65139
[5] https://security-tracker.debian.org/tracker/CVE-2026-65140
https://www.cve.org/CVERecord?id=CVE-2026-65140
[6] https://security-tracker.debian.org/tracker/CVE-2026-65165
https://www.cve.org/CVERecord?id=CVE-2026-65165
[7]
https://github.com/SchedMD/slurm/blob/slurm-26.05/CHANGELOG/slurm-26.05.md#changes-in-26054
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: slurm-wlm
Source-Version: 26.05.4-1
Done: Gennaro Oliva <[email protected]>
We believe that the bug you reported is fixed in the latest version of
slurm-wlm, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Gennaro Oliva <[email protected]> (supplier of updated slurm-wlm package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 03 Sep 2026 14:42:16 +0200
Source: slurm-wlm
Architecture: source
Version: 26.05.4-1
Distribution: unstable
Urgency: high
Maintainer: Debian HPC Team <[email protected]>
Changed-By: Gennaro Oliva <[email protected]>
Closes: 1146563
Changes:
slurm-wlm (26.05.4-1) unstable; urgency=high
.
* New upstream release (Closes: #1146563)
* Fix security vulnerabilities:
- CVE-2026-65107
- CVE-2026-65108
- CVE-2026-65109
- CVE-2026-65138
- CVE-2026-65139
- CVE-2026-65140
- CVE-2026-65165
Checksums-Sha1:
48bcd1204ea2afa58e9917337a807716fdf4924f 5415 slurm-wlm_26.05.4-1.dsc
fcd8af51000b75ecb680d266b40aa94113b6d7f1 9608686 slurm-wlm_26.05.4.orig.tar.gz
21e9c7c848cbda7026e904ab258cb5ff11b06189 140280
slurm-wlm_26.05.4-1.debian.tar.xz
66f341fb8df56635b4e2d28d2415ae24b0d67c25 30891
slurm-wlm_26.05.4-1_amd64.buildinfo
Checksums-Sha256:
59a55eb741dbfe9d31a8889c4ad1b1740f09dd716af7a6bfbef82e3938443ff3 5415
slurm-wlm_26.05.4-1.dsc
0e522d39324b7b7da5e8096c678c4af00500ca4c3fe2e6da7e4f8d01f7082ec7 9608686
slurm-wlm_26.05.4.orig.tar.gz
79b54ec4bf9185246b88325ec53b6b5558e1c6b21d2f2ea013ef9aad6d374940 140280
slurm-wlm_26.05.4-1.debian.tar.xz
11aee74f76de4b8d6dfc2595bc6fa8c5ff3c06fe28d8e1755580c94578ebf2f3 30891
slurm-wlm_26.05.4-1_amd64.buildinfo
Files:
96bd8bdecf6e38ea7f79e2e6f9a4c364 5415 admin optional slurm-wlm_26.05.4-1.dsc
394db6a8e0516597275aa09d4bcd9ba6 9608686 admin optional
slurm-wlm_26.05.4.orig.tar.gz
9bb8a2b03a8b0fb57a4ff071a2c38d35 140280 admin optional
slurm-wlm_26.05.4-1.debian.tar.xz
dc2936d5b38db204d7506915a1f73b9e 30891 admin optional
slurm-wlm_26.05.4-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEE6zNF9WRBuLgad5h2ffpBrZYZhdcFAmqdzvoRHG9saXZhQGRl
Ymlhbi5vcmcACgkQffpBrZYZhde4fQ/7BLZsZSVYHZmWrMts6+Nzirw/paYHj4if
TI6cwIMTGipXQ0nq3Rz51I0NPvXFPcxmJiG9lUMmw6tQlKfmPBafBJbjlsCc85EA
1KI3VhCkMwY4LP8bgqSIsE6ldTkB8ib8uHovayeIPPND80sAVuKCkaJYUUoGffjF
hEu/IY1Z+7M4AJmU5turip2rBemHVaApWttz1GpKoiYWlDMHuYJgcw0wNoDxJJpQ
zP8MA8uOmOXo0t/WfoYKFyxd9DSEj0aU+CQUqav6YdyNlOjkaY1l2atFIrAgdoEQ
h8x9jbjDCMm/+1aWEylwnk05MR5A2pNm/2mTxKEcSzVZJMtHkXjWcqMdymDn0Elw
BSxx4COOvq5wf9X6bn/0jY+odL/xP0jT4nb+Cyf8+O7D47Y04ZQL9X7aVFxGh70l
YQDKYNnLlkQwCGPm9yEtP7d8EKZtdRIDipvIVPwkvb/p2ZZqnafDH2h+OOXvlf82
mJ94vVNvNIY2TBQNfEqkpYcjFe54Shhw3NCll+q6eWXkusjUKAJ2Z2YAxPQJPMte
dWUpEb5BgWLT97ZDTf9LpURiHrqsb+j6r97cymMefBT9D2Gt/5leGVKmN1Pm+0Vn
V2GTwkZce2nPWlYalU3R5y379g5nwNq4RXd4nte7y5pMQPLKUMdHGYtrGyNErBMt
jey3oa8e6dM=
=Wyq9
-----END PGP SIGNATURE-----
pgp3yeciDCmmP.pgp
Description: PGP signature
--- End Message ---
