critical9.8
CVE-2024-24811
SQLAlchemyDA unauthenticated arbitrary SQL query execution
Impact
### Impact The vulnerability allows unauthenticated execution of arbitrary SQL statements on the database the SQLAlchemyDA instance is connected to. All users are affected. ### Patches The problem has been patched in version 2.2. ### Workarounds There is no workaround. All users are urged to upgrade to version 2.2
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | Products.SQLAlchemyDA | < 2.2 | 2.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zope | Sqlalchemyda | before 2.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/zopefoundation/Products.SQLAlchemyDA/commit/e682b99f8406f20bc3f0f2c77153ed7345fd215a
- https://github.com/zopefoundation/Products.SQLAlchemyDA/security/advisories/GHSA-r3jc-3qmm-w3pw
- https://github.com/advisories/GHSA-r3jc-3qmm-w3pw
- https://nvd.nist.gov/vuln/detail/CVE-2024-24811