CVE-2009-2940

Related Files

Ubuntu Security Notice 870-1

Posted Dec 11, 2009

Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 870-1 - Steffen Joeris discovered that PyGreSQL 3.8 did not use PostgreSQL's safe string and bytea functions in its own escaping functions. As a result, applications written to use PyGreSQL's escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences. Because the safe functions require a database connection, to maintain backwards compatibility, pg.escape_string() and pg.escape_bytea() are still available, but applications will have to be adjusted to use the new pyobj.escape_string() and pyobj.escape_bytea() functions. For example, code containing: import pg connection = pg.connect(...) escaped = pg.escape_string(untrusted_input) should be adjusted to use: import pg connection = pg.connect(...) escaped = connection.escape_string(untrusted_input)

tags | advisory, sql injection

systems | linux, ubuntu

advisories | CVE-2009-2940

SHA-256 | aaacaa34f44253d68ede2f284014b6c0ad9902914579e14f2eb61c04783c56ac

Download | Favorite | View

Debian Linux Security Advisory 1911-1

Posted Oct 15, 2009

Authored by Debian | Site debian.org

Debian Linux Security Advisory 1911-1 - It was discovered that pygresql, a PostgreSQL module for Python, was missing a function to call PQescapeStringConn(). This is needed, because PQescapeStringConn() honours the charset of the connection and prevents insufficient escaping, when certain multibyte character encodings are used. The new function is called pg_escape_string(), which takes the database connection as a first argument. The old function escape_string() has been preserved as well for backwards compatibility.

tags | advisory, python

systems | linux, debian

advisories | CVE-2009-2940

SHA-256 | 7172bcdaaf63fe0d62e1d2bc48815208e542c66a12e260a70767490b814d8ce0

Download | Favorite | View