CVE-2023-49934

An attacker can craft a malicious query containing unescaped SQL code, which will be passed to the SlurmDBD database without proper validation or parameterization. Due to the lack of authentication requirements, local network or user interaction (attack vector AV:N/AC:L/PR:N/UI:N), the exploit can be performed remotely by any attacker with network access to the service.

Successful exploitation of the vulnerability can lead to unauthorized read, modification, or deletion of data in the SlurmDBD database, and depending on the database server configuration — also to takeover of control over the entire HPC job management system.

SchedMD Slurm should be updated to version 23.11.1, which contains a patch eliminating the vulnerability. Updates are also available in Fedora distribution repositories.

SchedMD Slurm in versions from the 23.11.x branch (before 23.11.1).