CVE-2024-36039: SQL Injection
Last updated 24 July 2024
Other sources
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escapedict.
— GitHub
PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escapedict.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pymysqlto a version that resolves this vulnerability.Fixed in 1.1.1 - Upgrade
Upgrade
redhat/pymysqlto a version that resolves this vulnerability.Fixed in 1.1.1 - Upgrade
Upgrade
debian/python-pymysqlto a version that resolves this vulnerability.Fixed in 1.0.2-2+deb12u1 - Upgrade
Upgrade
debian/python-pymysqlto a version that resolves this vulnerability.Fixed in 1.1.1-1 - Upgrade
Upgrade
debian/python-pymysqlto a version that resolves this vulnerability.Fixed in 1.0.2-2+deb12u1Fixed in 1.1.1-2Fixed in 1.2.0-1 - Upgrade
Upgrade
PyMySQLto a version that resolves this vulnerability.Patch 521e40050cb386a499f68f483fefd144c493053c
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36039?
CVE-2024-36039 is classified as a high severity vulnerability due to its potential to allow SQL injection attacks.
How do I fix CVE-2024-36039?
To fix CVE-2024-36039, upgrade to PyMySQL version 1.1.1 or later.
What versions of PyMySQL are affected by CVE-2024-36039?
CVE-2024-36039 affects all PyMySQL versions up to and including 1.1.0.
Can CVE-2024-36039 affect applications using untrusted JSON input?
Yes, CVE-2024-36039 specifically allows SQL injection when untrusted JSON input is used.
What are the potential consequences of exploiting CVE-2024-36039?
Exploiting CVE-2024-36039 can lead to unauthorized access to the database and manipulation of sensitive data.