CVE-2009-2940
2 advisories.
PyPI/pygresql CVE-2009-2940: high, EPSS 2.70%
PyGreSQL Might Be Vulnerable to Encoding-Based SQL Injection
Action: Upgrade pygresql to 4.1 or later.
pip install pygresql==4.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 3.8.1 |
| 4.0 | 4.1 | - |
Fixed versions
| 4.1 |
Sources
- osv: GHSA-xv6x-43gq-4hfj
- https://nvd.nist.gov/vuln/detail/CVE-2009-2940
- https://github.com/PyGreSQL/PyGreSQL/commit/8e19320b130946eed6f043297e3e4e005a523612
- https://github.com/PyGreSQL/PyGreSQL/commit/f7237d773e6f4d5a7da3d99bb6bc5062bd07935e
- https://github.com/PyGreSQL/PyGreSQL
- https://github.com/pypa/advisory-database/tree/main/vulns/pygresql/PYSEC-2009-18.yaml
- http://ubuntu.com/usn/usn-870-1
- http://www.debian.org/security/2009/dsa-1911
CVE-2009-2940 · published · modified · JSON
PyPI/pygresql CVE-2009-2940: unknown, EPSS 2.70%
The pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character enc
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.8.1 | - | 4.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2009-18
- http://ubuntu.com/usn/usn-870-1
- http://www.osvdb.org/59028
- http://secunia.com/advisories/37046
- http://secunia.com/advisories/37654
- http://www.debian.org/security/2009/dsa-1911
- https://github.com/advisories/GHSA-xv6x-43gq-4hfj
CVE-2009-2940 · published · modified · JSON