Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 932396 (CVE-2024-36039)

Summary: <dev-python/pymysql-1.1.1: SQL injection if used with untrusted JSON input
Product: Gentoo Security Reporter: Michał Górny <mgorny>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: CONFIRMED ---    
Severity: normal CC: mysql-bugs, python
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://github.com/advisories/GHSA-v9hf-5j83-6xpp
Whiteboard: B3 [glsa?]
Package list:
Runtime testing required: ---
Bug Depends on: 932395    
Bug Blocks:    

Description Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2024-05-22 04:49:32 UTC
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.
Comment 1 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2024-05-22 09:19:54 UTC
cleanup done.