Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2024-9774: Python SQL Library Allows Unescaped Input
CVE-2024-9774 · published 1 year ago
Summary
A vulnerability in the Python SQL library allows attackers to inject malicious code into databases. This can happen when certain types of data are inserted directly into database queries. To protect your system, update to the latest version of the library.
What to do
- Update b2ck srl python-sql to version 1.5.2.
- Update canonical python-sql to version 0.8-1ubuntu0.1~esm1.
- Update canonical python-sql to version 0.9-1ubuntu0.1~esm1.
- Update canonical python-sql to version 1.1.0-1ubuntu0.1~esm1.
- Update canonical python-sql to version 1.3.0-1ubuntu0.1~esm1.
- Update canonical python-sql to version 1.4.0-1+deb12u1build0.24.04.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | b2ck srl | python-sql |
< 1.5.2 Fix: upgrade to 1.5.2
|
| Ubuntu:Pro:16.04:LTS | canonical | python-sql |
< 0.8-1ubuntu0.1~esm1 Fix: upgrade to 0.8-1ubuntu0.1~esm1
|
| Ubuntu:Pro:18.04:LTS | canonical | python-sql |
< 0.9-1ubuntu0.1~esm1 Fix: upgrade to 0.9-1ubuntu0.1~esm1
|
| Ubuntu:Pro:20.04:LTS | canonical | python-sql |
< 1.1.0-1ubuntu0.1~esm1 Fix: upgrade to 1.1.0-1ubuntu0.1~esm1
|
| Ubuntu:Pro:22.04:LTS | canonical | python-sql |
< 1.3.0-1ubuntu0.1~esm1 Fix: upgrade to 1.3.0-1ubuntu0.1~esm1
|
| Ubuntu:24.04:LTS | canonical | python-sql |
< 1.4.0-1+deb12u1build0.24.04.1 Fix: upgrade to 1.4.0-1+deb12u1build0.24.04.1
|
Original advisory text
A vulnerability was found in python-sql where unary operators do not escape non-Expression.
A vulnerability was found in python-sql where unary operators do not escape non-Expression.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-9774
- https://bugs.tryton.org/python-sql/93
- https://discuss.tryton.org/t/security-release-for-issue-93/7889
- https://foss.heptapod.net/tryton/python-sql/-/commit/f20551bbb8b3b4c4dd0a2c3d36f...
- https://github.com/advisories/GHSA-pq9p-pc3p-9hm4
- https://access.redhat.com/security/cve/CVE-2024-9774
- https://ubuntu.com/security/CVE-2024-9774 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-9774 Third Party Advisory
- https://discuss.tryton.org/t/security-release-for-issue-93 Third Party Advisory
- https://ubuntu.com/security/notices/USN-8765-1 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2332734
- https://discuss.tryton.org/t/security-release-for-issue-93/7889/3
- https://lists.debian.org/debian-lts-announce/2024/10/msg00023.html
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-150Improper Neutralization of Escape, Meta, or Control Sequences
Timeline
Published27 Dec 2024
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta