CVE-2009-2940: SQL Injection
PyGreSQL 3.8 did not use PostgreSQL’s safe string and bytea functions in its own escaping functions. As a result, applications written to use PyGreSQL’s escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences. Because the safe functions require a database connection, to maintain backwards compatibility, pg.escapestring() and pg.escapebytea() are still available, but applications will have to be adjusted to use the new pyobj.escapestring() and pyobj.escapebytea() functions. For example, code containing:
python import pg connection = pg.connect(...) escaped = pg.escapestring(untrustedinput) should be adjusted to use:
python import pg connection = pg.connect(...) escaped = connection.escapestring(untrustedinput)
Other sources
The pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2940?
CVE-2009-2940 is categorized as a medium severity vulnerability due to the risk of SQL injection.
How do I fix CVE-2009-2940?
To fix CVE-2009-2940, upgrade PyGreSQL to version 4.1 or later.
Which versions of PyGreSQL are affected by CVE-2009-2940?
CVE-2009-2940 affects PyGreSQL versions up to and including 3.8.1.
What type of vulnerability is CVE-2009-2940?
CVE-2009-2940 is an SQL injection vulnerability arising from improper handling of multi-byte character sequences.
What is the impact of CVE-2009-2940?
The impact of CVE-2009-2940 can allow an attacker to execute arbitrary SQL commands in affected applications.