GHSA-xv6x-43gq-4hfj

Suggest an improvement
Source
https://github.com/advisories/GHSA-xv6x-43gq-4hfj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-xv6x-43gq-4hfj/GHSA-xv6x-43gq-4hfj.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-xv6x-43gq-4hfj
Aliases
Published
2022-05-02T03:40:08Z
Modified
2024-12-04T05:39:23.265047Z
Summary
PyGreSQL Might Be Vulnerable to Encoding-Based SQL Injection
Details

PyGreSQL 3.8 did not use PostgreSQL’s safe string and bytea functions in its own escaping functions. As a result, applications written to use PyGreSQL’s escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences. Because the safe functions require a database connection, to maintain backwards compatibility, pg.escape_string() and pg.escape_bytea() are still available, but applications will have to be adjusted to use the new pyobj.escape_string() and pyobj.escape_bytea() functions. For example, code containing:

import pg
connection = pg.connect(...)
escaped = pg.escape_string(untrusted_input)

should be adjusted to use:

import pg
connection = pg.connect(...)
escaped = connection.escape_string(untrusted_input)
Database specific
{
    "nvd_published_at": "2009-10-22T16:30:00Z",
    "cwe_ids": [
        "CWE-89"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-08T21:31:52Z"
}
References

Affected packages

PyPI / pygresql

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
3.8.1

Affected versions

3.*

3.8.1

PyPI / pygresql

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0
Fixed
4.1

Affected versions

4.*

4.0