Moderate: python3 security update - SQL injection in python-pymysql
Summary
ALSA-2024:4245: Moderate: python3 security update. Affects python3.12-PyMySQL versions < 1.1.0-3.el8_10. Fixed in 1.1.0-3.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language that supports interfaces to many system calls and libraries. It is widely used for various applications and offers modules, classes, exceptions, and dynamic typing. One of the popular Python packages is python-pymysql, which provides a Python interface for MySQL databases.
Vulnerability Detail
The vulnerability (CVE-2024-36039) in python-pymysql allows for SQL injection if used with untrusted JSON input. This means that an attacker can manipulate JSON data in a way that leads to unauthorized SQL queries being executed against the MySQL database. The impact of this vulnerability can range from unauthorized data access to data manipulation or even complete compromise of the database.
How To Fix
Minimum fixed version
1.1.0-3.el8_10
This is the first release that contains the fix.
sudo dnf update python3.12-PyMySQLTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to validate and sanitize all user inputs, including JSON data, before using them in SQL queries. This can help mitigate the risk of SQL injection attacks.
Conclusion
In conclusion, the python-pymysql package is vulnerable to SQL injection if used with untrusted JSON input. This can lead to unauthorized SQL queries and potential compromise of the MySQL database. It is recommended to update the package to the latest version and follow best practices for input validation and sanitization to mitigate the risk of SQL injection attacks.
See every vulnerability recorded for python3.12-PyMySQL →
FAQ
The impact of this vulnerability can range from unauthorized data access to data manipulation or even complete compromise of the MySQL database.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, a fix is available for this vulnerability. It is recommended to update the python-pymysql package to version 1.1.0-3.el8_10 or later.
There are no known exploits for this vulnerability at the moment. However, it is important to apply the recommended fix to prevent any potential exploitation.
To mitigate the risk of SQL injection attacks, it is important to validate and sanitize all user inputs, including JSON data, before using them in SQL queries. Additionally, keeping all software and packages up to date with the latest security patches is crucial.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12-PyMySQL.
