CVE-2024-9774 Python-sql: python-sql unary operators does not escape non-expression
Attackers can inject SQL commands via unary operators in python-sql, potentially leading to code execution or data theft.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-9774?
CVE-2024-9774 is a medium-severity SQL injection vulnerability in python-sql, published on 27 Dec 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was found in python-sql where unary operators do not escape non-Expression.
Weakness: CWE-150
Which versions are affected by CVE-2024-9774?
3 open source packages ship an affected version, including python-sql.
| Package | Affected | Fixed in |
|---|---|---|
python-sql PyPI | All versions | 1.5.2 |
python-sql PyPI | All versions | 1.5.2 |
python-sql PyPI | All versions | 1.5.2 |
Linux distribution packages (4)
python-python-sql SUSE:Package Hub 15 SP5 | All versions | 1.5.1-bp155.3.6.1 |
python-python-sql SUSE:Package Hub 15 SP6 | All versions | 1.5.1-bp156.2.6.1 |
python-python-sql openSUSE:Leap 15.5 | All versions | 1.5.1-bp155.3.6.1 |
python-python-sql openSUSE:Leap 15.6 | All versions | 1.5.1-bp156.2.6.1 |
How do I fix CVE-2024-9774?
Upgrade python-sql to 1.5.2 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-9774 being exploited?
There is no known exploitation of CVE-2024-9774 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-9774, DLA-3932-1, DSA-5795-1, GHSA-pq9p-pc3p-9hm4, PYSEC-2026-1855, UBUNTU-CVE-2024-9774 and 3 more.