Moderate: python3.11-PyMySQL security update
Summary
ALSA-2024:4244: Moderate: python3.11-PyMySQL security update. Affects python3.11-PyMySQL versions < 1.0.2-2.el8_10. Fixed in 1.0.2-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python3.11-PyMySQL package is a pure-Python MySQL client library designed to be a drop-in replacement for MySQLdb. It is compatible with various Python implementations such as CPython, PyPy, IronPython, and Jython. This package allows developers to interact with MySQL databases using Python. It provides functionality for executing SQL queries, managing connections, and handling result sets.
Vulnerability Detail
The vulnerability identified in the python3.11-PyMySQL package is a SQL injection vulnerability that arises when the package is used with untrusted JSON input. This vulnerability is tracked as CVE-2024-36039. An attacker can exploit this vulnerability by injecting malicious SQL statements into the JSON input, leading to unauthorized access, data manipulation, or other malicious actions on the MySQL database. The impact of this vulnerability can vary depending on the privileges of the user executing the queries and the sensitivity of the data stored in the database.
How To Fix
Minimum fixed version
1.0.2-2.el8_10
This is the first release that contains the fix.
sudo dnf update python3.11-PyMySQLTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The python3.11-PyMySQL package is susceptible to a SQL injection vulnerability when used with untrusted JSON input. This vulnerability can be mitigated by updating the package to version 1.0.2-2.el8_10 or later. It is crucial for users of this package to apply the necessary updates to ensure the security of their MySQL database interactions.
See every vulnerability recorded for python3.11-PyMySQL →
FAQ
python3.11-PyMySQL is a pure-Python MySQL client library that aims to replace MySQLdb and works on various Python implementations.
The vulnerability allows for SQL injection, which can lead to unauthorized access, data manipulation, or other malicious actions on the MySQL database.
To fix this vulnerability, update the python3.11-PyMySQL package to version 1.0.2-2.el8_10 or later.
Yes, this vulnerability can be exploited remotely if the affected application accepts untrusted JSON input.
Updating the python3.11-PyMySQL package to the latest version is the recommended mitigation for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for python3.11-PyMySQL.
