932396 – (CVE-2024-36039) <dev-python/pymysql-1.1.1: SQL injection if used with untrusted JSON input

Bug 932396 (CVE-2024-36039) - <dev-python/pymysql-1.1.1: SQL injection if used with untrusted JSON input

Summary: <dev-python/pymysql-1.1.1: SQL injection if used with untrusted JSON input

Status:	CONFIRMED

Alias:	CVE-2024-36039

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal normal (vote)
Assignee:	Gentoo Security

URL:	https://github.com/advisories/GHSA-v9...
Whiteboard:	B3 [glsa?]
Keywords:

Depends on:	932395
Blocks:
	Show dependency tree

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Michał Górny archtester

2024-05-22 04:49:32 UTC

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.

Comment 1 Michał Górny archtester

2024-05-22 09:19:54 UTC

cleanup done.