CVE-2019-12838 SQL injection in n/a

Critical 9.8 Published 11 Jul 2019 Updated 4 Aug 2024

SQL injection in Slurm allows attackers to read or modify database contents, requiring immediate patching for cluster administrators.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-12838?

CVE-2019-12838 is a critical SQL injection vulnerability in Debian Debian Linux, published on 11 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SchedMD Slurm 17.11.x, 18.08.0 through 18.08.7, and 19.05.0 allows SQL Injection.

Weakness: CWE-89

Which versions are affected by CVE-2019-12838?

It affects 4 products.

Linux distribution packages (8)

`perl-Switch` SUSE:Linux Enterprise Module for Development Tools 15	All versions	`2.17-3.2.1`
`perl-Switch` SUSE:Linux Enterprise Module for Development Tools 15 SP1	All versions	`2.17-3.2.1`
`slurm` SUSE:Linux Enterprise Module for HPC 15	All versions	`17.11.13-6.18.1`
`perl-Switch` SUSE:Linux Enterprise Module for HPC 15 SP1	All versions	`2.17-3.2.1`
`slurm` SUSE:Linux Enterprise Module for HPC 15 SP1	All versions	`17.11.13-6.18.1`
`slurm` SUSE:Linux Enterprise Module for HPC 15 SP1	All versions	`18.08.8-3.4.1`
`slurm` openSUSE:Leap 15.0	All versions	`17.11.13-lp150.5.24.1`
`slurm` openSUSE:Leap 15.1	All versions	`18.08.8-lp151.2.3.1`

Products include Debian Debian Linux, Fedoraproject Fedora, Opensuse Leap, Schedmd Slurm.

How do I fix CVE-2019-12838?

Apply the vendor's patch.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2019-12838 being exploited?

There is no known exploitation of CVE-2019-12838 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DSA-4572-1, GHSA-h39m-vmcf-q43p, SUSE-SU-2019:2229-1, SUSE-SU-2019:2989-1, UBUNTU-CVE-2019-12838, openSUSE-SU-2019:2052-1 and 1 more.