==========================================================================
Ubuntu Security Notice USN-6801-1
May 30, 2024

python-pymysql vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

PyMySQL could be vulnerable to SQL injection attacks.

Software Description:
- python-pymysql: Pure-Python MySQL driver

Details:

It was discovered that PyMySQL incorrectly escaped untrusted JSON input. An
attacker could possibly use this issue to perform SQL injection attacks.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
   python3-pymysql                 1.0.2-2ubuntu1.1

Ubuntu 23.10
   python3-pymysql                 1.0.2-1ubuntu1.23.10.1

Ubuntu 22.04 LTS
   python3-pymysql                 1.0.2-1ubuntu1.22.04.1

Ubuntu 20.04 LTS
   python3-pymysql                 0.9.3-2ubuntu3.1

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6801-1
   CVE-2024-36039

Package Information:
   https://launchpad.net/ubuntu/+source/python-pymysql/1.0.2-2ubuntu1.1
   https://launchpad.net/ubuntu/+source/python-pymysql/1.0.2-1ubuntu1.23.10.1
   https://launchpad.net/ubuntu/+source/python-pymysql/1.0.2-1ubuntu1.22.04.1
   https://launchpad.net/ubuntu/+source/python-pymysql/0.9.3-2ubuntu3.1

Ubuntu 6801-1: PyMySQL Security Advisory Updates

May 30, 2024
PyMySQL could be vulnerable to SQL injection attacks.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS - Ubuntu 23.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS Summary: PyMySQL could be vulnerable to SQL injection attacks. Software Description: - python-pymysql: Pure-Python MySQL driver Details: It was discovered that PyMySQL incorrectly escaped untrusted JSON input. An attacker could possibly use this issue to perform SQL injection attacks.

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS python3-pymysql 1.0.2-2ubuntu1.1 Ubuntu 23.10 python3-pymysql 1.0.2-1ubuntu1.23.10.1 Ubuntu 22.04 LTS python3-pymysql 1.0.2-1ubuntu1.22.04.1 Ubuntu 20.04 LTS python3-pymysql 0.9.3-2ubuntu3.1 In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6801-1

CVE-2024-36039

Severity
Ubuntu Security Notice USN-6801-1

Package Information

https://launchpad.net/ubuntu/+source/python-pymysql/1.0.2-2ubuntu1.1 https://launchpad.net/ubuntu/+source/python-pymysql/1.0.2-1ubuntu1.23.10.1 https://launchpad.net/ubuntu/+source/python-pymysql/1.0.2-1ubuntu1.22.04.1 https://launchpad.net/ubuntu/+source/python-pymysql/0.9.3-2ubuntu3.1

Related News