GHSA-xv6x-43gq-4hfj

Опубликовано: 02 мая 2022

Источник: github

Github: Прошло ревью

Описание

PyGreSQL Might Be Vulnerable to Encoding-Based SQL Injection

PyGreSQL 3.8 did not use PostgreSQL’s safe string and bytea functions in its own escaping functions. As a result, applications written to use PyGreSQL’s escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences. Because the safe functions require a database connection, to maintain backwards compatibility, pg.escape_string() and pg.escape_bytea() are still available, but applications will have to be adjusted to use the new pyobj.escape_string() and pyobj.escape_bytea() functions. For example, code containing:

import pg connection = pg.connect(...) escaped = pg.escape_string(untrusted_input)

should be adjusted to use:

import pg connection = pg.connect(...) escaped = connection.escape_string(untrusted_input)

Ссылки

Пакеты

Наименование

PyGreSQL

pip

Затронутые версииВерсия исправления

<= 3.8.1

Отсутствует

Наименование

PyGreSQL

pip

Затронутые версииВерсия исправления

= 4.0

4.1

EPSS

Процентиль: 72%

0.00734

Низкий

CVE ID

CVE-2009-2940

Дефекты

CWE-89

Связанные уязвимости

CVE-2009-2940

ubuntu

больше 15 лет назад

The pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings.