Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhnNGMtcmd2bS05NjRn

SQL Injection in pycsw

A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to.

Permalink: https://github.com/advisories/GHSA-hg4c-rgvm-964g
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWhnNGMtcmd2bS05NjRn
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 6 years ago
Updated: 9 months ago

CVSS Score: 9.1
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Identifiers: GHSA-hg4c-rgvm-964g, CVE-2016-8640
References:

• https://nvd.nist.gov/vuln/detail/CVE-2016-8640
• https://github.com/geopython/pycsw/pull/474/files
• https://github.com/advisories/GHSA-hg4c-rgvm-964g
• https://patch-diff.githubusercontent.com/raw/geopython/pycsw/pull/474.patch
• http://seclists.org/oss-sec/2016/q4/406
• http://www.securityfocus.com/bid/94302
• https://github.com/geopython/pycsw/commit/522873e5ce48bb9cbd4e7e8168ca881ce709c222
• https://github.com/geopython/pycsw/commit/69546e13527c82e4f9191769215490381ad511b2
• https://github.com/geopython/pycsw/commit/daaf09b4b920708a415be3c7f446739661ba3753

Repository: https://github.com/geopython/pycsw
Blast Radius: 18.6

Affected Packages