Ubuntu Security Notice 870-1 - Steffen Joeris discovered that PyGreSQL 3.8 did not use PostgreSQL's safe string and bytea functions in its own escaping functions. As a result, applications written to use PyGreSQL's escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences. Because the safe functions require a database connection, to maintain backwards compatibility, pg.escape_string() and pg.escape_bytea() are still available, but applications will have to be adjusted to use the new pyobj.escape_string() and pyobj.escape_bytea() functions. For example, code containing: import pg connection = pg.connect(...) escaped = pg.escape_string(untrusted_input) should be adjusted to use: import pg connection = pg.connect(...) escaped = connection.escape_string(untrusted_input)
aaacaa34f44253d68ede2f284014b6c0ad9902914579e14f2eb61c04783c56acDebian Linux Security Advisory 1911-1 - It was discovered that pygresql, a PostgreSQL module for Python, was missing a function to call PQescapeStringConn(). This is needed, because PQescapeStringConn() honours the charset of the connection and prevents insufficient escaping, when certain multibyte character encodings are used. The new function is called pg_escape_string(), which takes the database connection as a first argument. The old function escape_string() has been preserved as well for backwards compatibility.
7172bcdaaf63fe0d62e1d2bc48815208e542c66a12e260a70767490b814d8ce0
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed