Junglewise Threat Intelligence

CVE-2009-2940: PyGreSQL SQL injection via encoding-based escaping bypass

CVE-2009-2940 · Severity: high · CVSS 7.5 · Published 2022-05-02

Vendors: PyPI.

Executive brief

PyGreSQL, a Python interface for the PostgreSQL database, contains a vulnerability that could allow attackers to bypass security filters. When an application processes certain multi-byte characters, the library's built-in data cleaning functions may fail to properly neutralize malicious commands. This could lead to unauthorized access to sensitive data or the ability to modify database records.

Technical details

PyGreSQL versions 3.8.1 and 4.0 fail to use PostgreSQL's connection-aware escaping functions (PQescapeStringConn and PQescapeByteaConn) in their global pg.escape_string() and pg.escape_bytea() methods. This allows for SQL injection attacks when using certain multi-byte character encodings (like those used in some Asian languages) where an attacker can craft a sequence that 'consumes' the escape character. To mitigate this, developers must migrate from the global escaping functions to the connection-specific methods (e.g., connection.escape_string()) which correctly honor the charset of the active database connection. The issue is addressed in version 4.1.

Affected products

  • PyGreSQL PyGreSQL <= 3.8.1, 4.0

Timeline

  • 2009-10-14: advisory: Debian Security Advisory DSA-1911-1 published
  • 2009-10-22: disclosed: NVD publication date
  • 2009-12-11: advisory: Ubuntu Security Notice USN-870-1 published
  • 2022-05-02: advisory: GitHub Advisory Database entry published

References