CVE-2009-2940

PyGreSQL 3.8.1 and 4.0 - SQL Injection via Multibyte Character Encoding

Title source: llm
STIX 2.1

Description

The pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings.

References (5)

Core 5
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37046
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2009/dsa-1911
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://www.osvdb.org/59028
Various Sources vendor-advisory x_refsource_ubuntu
http://ubuntu.com/usn/usn-870-1
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37654

Scores

EPSS 0.0270
EPSS Percentile 84.4%

Details

Status published
Products (4)
pygresql/pygresql 3.8.1
pygresql/pygresql 4.0
pypi/PyGreSQL 0 - 3.8.1PyPI
pypi/PyGreSQL 4.0 - 4.1PyPI
Published Oct 22, 2009
Tracked Since Feb 18, 2026