USN-6801-1: PyMySQL vulnerability
Published May 30, 2024
·Updated
It was discovered that PyMySQL incorrectly escaped untrusted JSON input. An attacker could possibly use this issue to perform SQL injection attacks.
Affected Software
8 affected componentsFixes available
All of the following
ubuntu/python3-pymysql<1.0.2-2ubuntu1.1
1.0.2-2ubuntu1.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/python3-pymysql<1.0.2-1ubuntu1.23.10.1
1.0.2-1ubuntu1.23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/python3-pymysql<1.0.2-1ubuntu1.22.04.1
1.0.2-1ubuntu1.22.04.1
Ubuntu Ubuntu=22.04
All of the following
ubuntu/python3-pymysql<0.9.3-2ubuntu3.1
0.9.3-2ubuntu3.1
Ubuntu Ubuntu=20.04
Event History
May 30, 2024
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-6801-1?
The vulnerability USN-6801-1 has a critical severity due to the potential for SQL injection attacks.
2
How do I fix USN-6801-1?
To fix USN-6801-1, upgrade the PyMySQL package to the remedied version specified for your Ubuntu version.
3
What versions of Ubuntu are affected by USN-6801-1?
USN-6801-1 affects multiple Ubuntu versions, including 20.04, 22.04, 23.10, and 24.04.
4
What is the impact of USN-6801-1?
The impact of USN-6801-1 can allow attackers to execute unauthorized SQL commands through crafted JSON input.
5
Is USN-6801-1 related to JSON processing?
Yes, USN-6801-1 specifically involves improper escaping of untrusted JSON input leading to SQL injection risks.