SQL injection in PyMySQL - CVE-2024-36039

Vulnerability identifier: #VU94524

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-36039

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied JSON input. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

PyMySQL
Debian Linux
Oracle Linux
Fedora
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
openSUSE Leap
openEuler
Ubuntu
PowerVC
python-PyMySQL
python2-PyMySQL
python3-PyMySQL
python-pymysql (Debian package)
python3-pymysql (Ubuntu package)
python3.11-PyMySQL (Red Hat package)
python3.12-PyMySQL (Red Hat package)
python311-PyMySQL

Install update from vendor's website.

PyMySQL - update to 1.1.1
python-PyMySQL - update to 0.9.2-4
python2-PyMySQL - update to 0.9.2-4
python3-PyMySQL - update to 0.9.2-4
python-PyMySQL - addressed in versions 0.9.3-2.el7, 1.1.1-1.fc39, 1.1.1-1.fc40
python-pymysql (Debian package) - addressed in versions 0.9.3-2+deb11u1, 1.0.2-2+deb12u1
python3-pymysql (Ubuntu package) - addressed in versions 0.9.3-2ubuntu3.1, 1.0.2-1ubuntu1.22.04.1, 1.0.2-1ubuntu1.23.10.1, 1.0.2-2ubuntu1.1
python3.11-PyMySQL (Red Hat package) - update to 1.0.2-2.el9
python3.12-PyMySQL (Red Hat package) - update to 1.1.0-3.el9
python311-PyMySQL - update to 1.1.0-150600.3.3.1

• https://github.com/PyMySQL/PyMySQL/releases/tag/v1.1.1
• https://lists.debian.org/debian-lts-announce/2024/05/msg00017.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35VOJS3SRJNLQIO7YTZFNM6RWHIHWTMK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/23VXBV34GFRICCVYZ6KFMSSWY5UEXCF5/

• SQL injection in PyMySQL
• Debian update for python-pymysql
• Ubuntu update for python-pymysql
• SUSE update for python-PyMySQL
• Fedora 39 update for python-PyMySQL
• Fedora 40 update for python-PyMySQL
• Fedora EPEL 7 update for python-PyMySQL
• openEuler update for python-PyMySQL
• Multiple vulnerabilities in Oracle Linux
• SQL injection in IBM PowerVC
• Red Hat Enterprise Linux 9 update for python3.12-PyMySQL
• Red Hat Enterprise Linux 9 update for python3.11-PyMySQL