GitHub Advisoryadvisory · PyPI

GHSA-r3jc-3qmm-w3pw SQLAlchemyDA unauthenticated arbitrary SQL query execution

CRITICAL Published 2024-02-07 Modified 2024-02-14 Official page ↗
Aliases
CVE-2024-24811
Ecosystem
PyPI
Packages
Products.SQLAlchemyDA
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2024-02-07

Affected packages

• PyPI Products.SQLAlchemyDA: < 2.2 → fixed in 2.2

Description

Impact The vulnerability allows unauthenticated execution of arbitrary SQL statements on the database the SQLAlchemyDA instance is connected to. All users are affected. Patches The problem has been patched in version 2.2. Workarounds There is no workaround. All users are urged to upgrade to version 2.2

Related

Alias · CVE (1)

  • CVE-2024-24811 SQLAlchemyDA is a generic database adapter for ZSQL methods. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References