Most recent entries from all

ALSA-2024:4244 — Moderate: python3.11-PyMySQL security update

Affected: AlmaLinux:8: python3.11-PyMySQL

This package contains a pure-Python MySQL client library. The goal of PyMySQL is to be a drop-in replacement for MySQLdb and work on CPython, PyPy, IronPython and Jython.

Security Fix(es):

* python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

bdu:2024-04920

BREW-dolphie-CVE-2024-36039 — PyMySQL SQL Injection vulnerability

Affected: Homebrew: dolphie

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by `escape_dict`.

EUVD-2026-203264

fkie_cve-2024-36039

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.

GHSA-v9hf-5j83-6xpp — PyMySQL SQL Injection vulnerability

Affected: PyPI: pymysql

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by `escape_dict`.

msrc_CVE-2024-36039 — PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dic…

msrc_CVE-2024-36039

OESA-2024-1719 — python-PyMySQL security update

Affected: openEuler:20.03-LTS-SP4: python-PyMySQL, openEuler:22.03-LTS-SP1: python-PyMySQL, openEuler:22.03-LTS-SP3: python-PyMySQL, openEuler:24.03-LTS: python-PyMySQL

This package contains a pure-Python MySQL client library, based on PEP 249. Most public APIs are compatible with mysqlclient and MySQLdb. Security Fix(es): PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.(CVE-2024-36039)

openSUSE-SU-2024:13993-1 — python310-PyMySQL-1.1.1-1.1 on GA media

python310-PyMySQL-1.1.1-1.1 on GA media

PYSEC-2026-502 — PyMySQL SQL Injection vulnerability

Affected: PyPI: pymysql

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by `escape_dict`.

RHBA-2024:5039 — Red Hat Bug Fix Advisory: Red Hat Quay v3.12.1 bug fix release

pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools python-pymysql: SQL injection if used with untrusted JSON input

SUSE-SU-2024:1855-1 — Security update for python-PyMySQL

Security update for python-PyMySQL

UBUNTU-CVE-2024-36039

Affected: Ubuntu:16.04:LTS: python-pymysql, Ubuntu:18.04:LTS: python-pymysql, Ubuntu:20.04:LTS: python-pymysql, Ubuntu:22.04:LTS: python-pymysql, Ubuntu:24.04:LTS: python-pymysql

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.

WID-SEC-W-2024-1513 — Red Hat Enterprise Linux (PyMySQL): Schwachstelle ermöglicht SQL Injection

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um eine SQL Injection durchzuführen.