CVE-2024-24811 Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2024-24811?
CVE-2024-24811 is a critical vulnerability in zopefoundation Products.SQLAlchemyDA, published on 7 Feb 2024.
Official description
SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version 2.2. There is no workaround for the problem.
Weakness: CWE-89
Which versions are affected by CVE-2024-24811?
3 open source packages ship an affected version, including Products.SQLAlchemyDA and products-sqlalchemyda. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Products.SQLAlchemyDA PyPI | All versions | 2.2 |
products-sqlalchemyda PyPI | All versions | 2.2 |
products-sqlalchemyda PyPI | All versions | 2.2 |
Products include Zope Sqlalchemyda.
How do I fix CVE-2024-24811?
Upgrade Products.SQLAlchemyDA to 2.2 or later.
Is CVE-2024-24811 being exploited?
There is no known exploitation of CVE-2024-24811 in the wild and no public exploit code.
Sources
Also known as GHSA-r3jc-3qmm-w3pw, PYSEC-2026-489.