{"action":"Upgrade asyncpg to 0.21.0 or later.","affected":[{"fixed":"0.21.0","introduced":"0"}],"component":"asyncpg","cve_ids":["CVE-2020-17446"],"ecosystem":"PyPI","epss":0.02417,"exploited":false,"fixed_versions":["0.21.0"],"ghsa_id":"GHSA-2xpj-f5g2-8p7m","id":"tcs_01M5KG9ZJNERH3HE79TPS2QG8T","modified_at":"2023-11-08T04:02:41.394352Z","published_at":"2020-08-12T16:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-24","https://github.com/MagicStack/asyncpg/releases/tag/v0.21.0","https://lists.debian.org/debian-lts-announce/2020/09/msg00002.html","https://github.com/advisories/GHSA-2xpj-f5g2-8p7m"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-24","url":"https://osv.dev/vulnerability/PYSEC-2020-24"}],"summary":"asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, because of access to an uninitialized poin"}