CVE-2023-36189: SQL Injection

Q: What is the severity of CVE-2023-36189?

CVE-2023-36189 is considered a critical severity SQL injection vulnerability that can lead to sensitive information disclosure.

Q: How do I fix CVE-2023-36189?

To fix CVE-2023-36189, upgrade langchain to version 0.0.247 or later.

Q: What components are affected by CVE-2023-36189?

CVE-2023-36189 affects the SQLDatabaseChain component of langchain prior to version 0.0.247.

Q: Can CVE-2023-36189 be exploited remotely?

Yes, CVE-2023-36189 can be exploited remotely by an attacker to access sensitive information.

Q: What types of attacks does CVE-2023-36189 allow?

CVE-2023-36189 allows for SQL injection attacks, enabling unauthorized data access.

Published Jul 6, 2023

Updated

SQL injection vulnerability in langchain allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.

Other sources

SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.

SQL injection vulnerability in langchain v.0.0.64 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain component.

Affected Software

2 affected componentsFixes available

pip/langchain>=0<0.0.247

0.0.247

Langchain Langchain=0.0.64

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/langchain to a version that resolves this vulnerability.
Fixed in 0.0.247

Event History

Jul 6, 2023

CVE Published

12:00 AM

Data Sourced

12:00 AM

Description

Advisory Published

03:30 PM

Frequently Asked Questions

What is the severity of CVE-2023-36189?

CVE-2023-36189 is considered a critical severity SQL injection vulnerability that can lead to sensitive information disclosure.

How do I fix CVE-2023-36189?