Advisory details:
github_osv / GHSA-xv6x-43gq-4hfj
| Advisory ID | github_osv/GHSA-xv6x-43gq-4hfj |
| Aliases |
CVE-2009-2940
|
| Summary | PyGreSQL Might Be Vulnerable to Encoding-Based SQL Injection PyGreSQL 3.8 did not use PostgreSQL’s safe `string` and `bytea` functions in its own escaping functions. As a result, applications written to use PyGreSQL’s escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences. Because the safe functions require a database connection, to maintain backwards compatibility, `pg.escape_string()` and `pg.escape_bytea()` are still available, but applications will have to be adjusted to use the new `pyobj.escape_string()` and `pyobj.escape_bytea()` functions. For example, code containing: ```python import pg connection = pg.connect(...) escaped = pg.escape_string(untrusted_input) ``` should be adjusted to use: ```python import pg connection = pg.connect(...) escaped = connection.escape_string(untrusted_input) ``` |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| generic_textual | HIGH |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no SSVC decisions available.