Open-source package vulnerability · PyPI

CVE-2024-24811: SQLAlchemyDA unauthenticated arbitrary SQL query execution

criticalCVSS 3.1 9.8GHSA-r3jc-3qmm-w3pw

Impact The vulnerability allows unauthenticated execution of arbitrary SQL statements on the database the SQLAlchemyDA instance is connected to. All users are affected. Patches The problem has been patched in version 2.2. Workarounds There is no workaround. All users are urged to upgrade to version 2.2

Published Feb 7, 2024 · Updated Feb 14, 2024

Affected packages

Products.SQLAlchemyDA

Ecosystem: PyPI
Affected: < 2.2
Fixed in: 2.2
Check: pip show Products.SQLAlchemyDA

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

The vulnerability allows unauthenticated execution of arbitrary SQL statements on the database the SQLAlchemyDA instance is connected to. All users are affected.

Patches

The problem has been patched in version 2.2.

Workarounds

There is no workaround. All users are urged to upgrade to version 2.2

Credited to perrinjerome, dataflake.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology