Security Bulletin: PyMySQL allows SQL injection [CVE-2024-36039]

2024-08-1413:09:15

www.ibm.com

pymysql

sql injection

powervc

cve-2024-36039

json input

database

fix

ibm

security bulletin

AI Score

7.6

Confidence

Low

JSON

Summary

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.

Vulnerability Details

CVEID:CVE-2024-36039
**DESCRIPTION:**PyMySQL is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/291236 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
PowerVC	2.1.1
PowerVC	2.1.1.1
PowerVC	2.2.0
PowerVC	2.2.1

Remediation/Fixes

PowerVC Version	Fix
2.1.1	https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7EOther%20software&product=ibm/Other+software/PowerVC&release=2.1.1&platform=All&function=fixId&fixids=2.1.1-PowerVC-RHEL-SLES-NOARCH-APAR-IT46558&includeRequisites=1&includeSupersedes=0&downloadMethod=http&login=true
2.1.1.1	https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7EOther%20software&product=ibm/Other+software/PowerVC&release=2.1.1.1&platform=All&function=fixId&fixids=2.1.1.1-PowerVC-RHEL-SLES-NOARCH-APAR-IT46559&includeRequisites=1&includeSupersedes=0&downloadMethod=http
2.2.0	https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7EOther%20software&product=ibm/Other+software/PowerVC&release=2.2.0&platform=All&function=fixId&fixids=2.2.0-PowerVC-RHEL-SLES-NOARCH-APAR-IT46560&includeRequisites=1&includeSupersedes=0&downloadMethod=http
2.2.1	https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=ibm%7EOther%20software&product=ibm/Other+software/PowerVC&release=2.2.1&platform=All&function=fixId&fixids=2.2.1-PowerVC-RHEL-SLES-NOARCH-APAR-IT46561&includeRequisites=1&includeSupersedes=0&downloadMethod=http

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmpowervcMatch2.1.1standard

ibmpowervcMatch2.1.1.1standard

ibmpowervcMatch2.2.0standard

ibmpowervcMatch2.2.1standard

VendorProductVersionCPE
ibmpowervc2.1.1cpe:2.3:a:ibm:powervc:2.1.1:*:*:*:standard:*:*:*
ibmpowervc2.1.1.1cpe:2.3:a:ibm:powervc:2.1.1.1:*:*:*:standard:*:*:*
ibmpowervc2.2.0cpe:2.3:a:ibm:powervc:2.2.0:*:*:*:standard:*:*:*
ibmpowervc2.2.1cpe:2.3:a:ibm:powervc:2.2.1:*:*:*:standard:*:*:*

Vendor	Product	Version	CPE
ibm	powervc	2.1.1	cpe:2.3:a:ibm:powervc:2.1.1::::standard:::
ibm	powervc	2.1.1.1	cpe:2.3:a:ibm:powervc:2.1.1.1::::standard:::
ibm	powervc	2.2.0	cpe:2.3:a:ibm:powervc:2.2.0::::standard:::
ibm	powervc	2.2.1	cpe:2.3:a:ibm:powervc:2.2.1::::standard:::