CVE-2023-49934: 
NixOS vulnerability analysis and mitigation

A SQL injection vulnerability (CVE-2023-49934) was discovered in SchedMD Slurm version 23.11.x affecting the SlurmDBD database. The vulnerability was disclosed in December 2023 and has been fixed in version 23.11.1 (Slurm Announce).

The vulnerability allows for arbitrary SQL injection attacks against SlurmDBD's SQL database. The issue has been assigned a CVSS v3.1 base score of 9.8 CRITICAL with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a critical severity level with potential for high impact on confidentiality, integrity, and availability (NVD).

The vulnerability could allow attackers to perform arbitrary SQL injection against the SlurmDBD database, potentially leading to unauthorized access, data manipulation, or exposure of sensitive information stored in the database (Slurm Announce).

There are no mitigations available for this vulnerability; the only option is to patch and restart the affected daemons. The issue has been fixed in Slurm version 23.11.1. Users are strongly encouraged to upgrade to the fixed version immediately (Slurm Announce).