CVE-2024-36039

2024-05-2116:15:26

Debian Security Bug Tracker

security-tracker.debian.org

pymysql

sql injection

untrusted json

escape_dict

security vulnerability

AI Score

8.4

Confidence

Low

EPSS

Percentile

15.6%

JSON

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.

OSVersionArchitecturePackageVersionFilename
Debian12allpython-pymysql< 1.0.2-2+deb12u1python-pymysql_1.0.2-2+deb12u1_all.deb
Debian11allpython-pymysql< 0.9.3-2+deb11u1python-pymysql_0.9.3-2+deb11u1_all.deb
Debian999allpython-pymysql< 1.1.1-1python-pymysql_1.1.1-1_all.deb
Debian13allpython-pymysql< 1.1.1-1python-pymysql_1.1.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	python-pymysql	< 1.0.2-2+deb12u1	python-pymysql_1.0.2-2+deb12u1_all.deb
Debian	11	all	python-pymysql	< 0.9.3-2+deb11u1	python-pymysql_0.9.3-2+deb11u1_all.deb
Debian	999	all	python-pymysql	< 1.1.1-1	python-pymysql_1.1.1-1_all.deb
Debian	13	all	python-pymysql	< 1.1.1-1	python-pymysql_1.1.1-1_all.deb