Home

CVE-2024-36039

Description

PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.

Risk Information

Base Score
6.3
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score
Exploitation Probability
0.1

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2024-36039 are fixed in Python-pymysql 1.1.1Windows
Pure-Python MySQL driver (USN-6801-1) python3-pymysql_0.9.3-2ubuntu3.1_all.debLinux
Pure-Python MySQL driver (USN-6801-1) python3-pymysql_1.0.2-1ubuntu1.22.04.1_all.debLinux
Pure-Python MySQL driver (USN-6801-1) python3-pymysql_1.0.2-1ubuntu1.23.10.1_all.debLinux
Pure-Python MySQL driver (USN-6801-1) python3-pymysql_1.0.2-2ubuntu1.1_all.debLinux
(RHSA-2024:4244)Moderate: security update python3.11-PyMySQL-1.0.2-2.el8_10.noarch.rpmLinux
(RHSA-2024:4245)Moderate: security update python3.12-PyMySQL-1.1.0-3.el8_10.noarch.rpmLinux
Python3.11-PyMySQL update (ELSA-2024-4244) python3.11-PyMySQL-1.0.2-2.el8_10.noarch.rpmLinux
Python3.12-PyMySQL update (ELSA-2024-4245) python3.12-PyMySQL-1.1.0-3.el8_10.noarch.rpmLinux
python-pymysql security update(DSA-5700-1) python3-pymysql_1.0.2-2+deb12u1_all.debLinux
python-pymysql security update(DSA-5700-1) python3-pymysql_0.9.3-2+deb11u1_all.debLinux
python-pymysql security update(DSA-5700-1) python-pymysql-doc_1.0.2-2+deb12u1_all.debLinux
python-pymysql security update(DSA-5700-1) python-pymysql-doc_0.9.3-2+deb11u1_all.debLinux
(RHSA-2024:9193)Moderate: security update python3.12-PyMySQL+rsa-1.1.0-3.el9.noarch.rpmLinux
(RHSA-2024:9193)Moderate: security update python3.12-PyMySQL-1.1.0-3.el9.noarch.rpmLinux
(RHSA-2024:9194)Moderate: security update python3.11-PyMySQL+rsa-1.0.2-2.el9.noarch.rpmLinux
(RHSA-2024:9194)Moderate: security update python3.11-PyMySQL-1.0.2-2.el9.noarch.rpmLinux
Python3.11-PyMySQL+rsa update (ELSA-2024-9194) python3.11-PyMySQL+rsa-1.0.2-2.el9.noarch.rpmLinux
Python3.11-PyMySQL update (ELSA-2024-9194) python3.11-PyMySQL-1.0.2-2.el9.noarch.rpmLinux
Python3.12-PyMySQL update (ELSA-2024-9193) python3.12-PyMySQL-1.1.0-3.el9.noarch.rpmLinux
Python3.12-PyMySQL+rsa update (ELSA-2024-9193) python3.12-PyMySQL+rsa-1.1.0-3.el9.noarch.rpmLinux
python3.11-PyMySQL security update (RLSA-2024:9194) python3.11-PyMySQL+rsa-1.0.2-2.el9.noarch.rpmLinux
python3.11-PyMySQL security update (RLSA-2024:9194) python3.11-PyMySQL-1.0.2-2.el9.noarch.rpmLinux
python3.12-PyMySQL security update (RLSA-2024:9193) python3.12-PyMySQL+rsa-1.1.0-3.el9.noarch.rpmLinux
python3.12-PyMySQL security update (RLSA-2024:9193) python3.12-PyMySQL-1.1.0-3.el9.noarch.rpmLinux
Moderate: python3.11-PyMySQL security update python3.11-PyMySQL-1.0.2-2.el8_10.noarch.rpmLinux
Moderate: python3 security update python3.12-PyMySQL-1.1.0-3.el8_10.noarch.rpmLinux
Moderate: python3.12-PyMySQL security update python3.12-PyMySQL-1.1.0-3.el9.noarch.rpmLinux
Moderate: python3.12-PyMySQL security update python3.12-PyMySQL+rsa-1.1.0-3.el9.noarch.rpmLinux
Moderate: python3.11-PyMySQL security update python3.11-PyMySQL-1.0.2-2.el9.noarch.rpmLinux
Moderate: python3.11-PyMySQL security update python3.11-PyMySQL+rsa-1.0.2-2.el9.noarch.rpmLinux
python3.11-PyMySQL security update (RLSA-2024:4244) python3.11-PyMySQL-1.0.2-2.el8_10.noarch.rpmLinux
python3 security update (RLSA-2024:4245) python3.12-PyMySQL-1.1.0-3.el8_10.noarch.rpmLinux
Vulnerabilities CVE-2024-36039 are fixed in Python-pymysql for linux 1.1.1Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234