CVE-2009-2940 – pygresql

Package

Manager: pip
Name: pygresql
Vulnerable Version: >=0 <=3.8.1 || =4.0 || >=4.0 <4.1

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:U/RC:R

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00687 pctl0.70835

Details

PyGreSQL Might Be Vulnerable to Encoding-Based SQL Injection PyGreSQL 3.8 did not use PostgreSQL’s safe `string` and `bytea` functions in its own escaping functions. As a result, applications written to use PyGreSQL’s escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences. Because the safe functions require a database connection, to maintain backwards compatibility, `pg.escape_string()` and `pg.escape_bytea()` are still available, but applications will have to be adjusted to use the new `pyobj.escape_string()` and `pyobj.escape_bytea()` functions. For example, code containing: ```python import pg connection = pg.connect(...) escaped = pg.escape_string(untrusted_input) ``` should be adjusted to use: ```python import pg connection = pg.connect(...) escaped = connection.escape_string(untrusted_input) ```

Metadata

Created: 2022-05-02T03:40:08Z
Modified: 2024-02-08T21:31:52Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xv6x-43gq-4hfj/GHSA-xv6x-43gq-4hfj.json
CWE IDs: ["CWE-89"]
Alternative ID: GHSA-xv6x-43gq-4hfj
Finding: F297
Auto approve: 1