python-sql SQL injection vulnerability
A vulnerability was found in python-sql where unary operators do not escape non-Expression (like `And` and `Or`) which makes any system exposing those vulnerable to an SQL injection attack.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-9774US | — | — | ||
A vulnerability was found in python-sql where unary operators do not escape non-Expression. | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/CVE-2024-9774WEB
- https://bugs.tryton.org/python-sql/93WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2332734WEB
- https://discuss.tryton.org/t/security-release-for-issue-93/7889WEB
- https://discuss.tryton.org/t/security-release-for-issue-93/7889/3WEB
- https://foss.heptapod.net/tryton/python-sql/-/commit/f20551bbb8b3b4c4dd0a2c3d36f377bff6f2f349WEB
- https://github.com/advisories/GHSA-pq9p-pc3p-9hm4ADVISORY
- https://github.com/tryton/python-sqlPACKAGE
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan