USN-870-1 -- pygresql vulnerabilityID: oval:org.secpod.oval:def:700387 | Date: (C)2011-05-13 (M)2021-07-09 |
Class: PATCH | Family: unix |
Steffen Joeris discovered that PyGreSQL 3.8 did not use PostgreSQL"s safe string and bytea functions in its own escaping functions. As a result, applications written to use PyGreSQL"s escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences. Because the safe functions require a database connection, to maintain backwards compatibility, pg.escape_string and pg.escape_bytea are still available, but applications will have to be adjusted to use the new pyobj.escape_string and pyobj.escape_bytea functions. For example, code containing: import pg connection = pg.connect escaped = pg.escape_string should be adjusted to use: import pg connection = pg.connect escaped = connection.escape_string
Platform: |
Ubuntu 8.10 |
Ubuntu 8.04 |