Red Hat: CVE-2024-36039: python-pymysql: SQL injection if used with untrusted JSON input (Multiple Advisories)

Red Hat: CVE-2024-36039: python-pymysql: SQL injection if used with untrusted JSON input (Multiple Advisories)

Severity

7

CVSS

(AV:N/AC:L/Au:S/C:P/I:P/A:P)

Published

05/21/2024

Created

07/03/2024

Added

07/03/2024

Modified

11/13/2024

Description

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.

Solution(s)

• redhat-upgrade-python3-11-pymysql
• redhat-upgrade-python3-11-pymysql-rsa
• redhat-upgrade-python3-12-pymysql
• redhat-upgrade-python3-12-pymysql-rsa

References

• CVE-2024-36039
• RHSA-2024:4244
• RHSA-2024:4245
• RHSA-2024:9193
• RHSA-2024:9194