CVE-2024-24811: Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution
Impact The vulnerability allows unauthenticated execution of arbitrary SQL statements on the database the SQLAlchemyDA instance is connected to. All users are affected.
Patches The problem has been patched in version 2.2.
Workarounds There is no workaround. All users are urged to upgrade to version 2.2
Other sources
SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version 2.2. There is no workaround for the problem.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Products.SQLAlchemyDAto a version that resolves this vulnerability.Fixed in 2.2 - Upgrade
Upgrade
Products.SQLAlchemyDAto a version that resolves this vulnerability.Fixed in 2.2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-24811?
CVE-2024-24811 is considered a critical vulnerability due to its ability to allow unauthenticated execution of arbitrary SQL statements on the connected database.
How do I fix CVE-2024-24811?
To fix CVE-2024-24811, you should upgrade to version 2.2 or later of Products.SQLAlchemyDA.
Who is affected by CVE-2024-24811?
All users of Products.SQLAlchemyDA are affected by CVE-2024-24811 regardless of their configuration or usage.
Is there a workaround for CVE-2024-24811?
There is no workaround for CVE-2024-24811; the only solution is to upgrade to the patched version.
When was CVE-2024-24811 patched?
CVE-2024-24811 was patched in version 2.2 of Products.SQLAlchemyDA.