~ / search / GHSA-gmpq-xrxj-xh8m

GHSA-gmpq-xrxj-xh8m

Arches vulnerable to execution of arbitrary SQL

Source: GitHub Advisory Database (reviewed) High CVE-2022-41892

Packages

EcosystemPackageAffectedFixed in
PyPI arches < 6.1.2 6.1.2
PyPI arches >= 6.2.0, < 6.2.1 6.2.1
PyPI arches >= 7.0.0, < 7.2.0 7.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. Anyone running the impacted versions (<=6.1.1, 6.2.0, >=7.0.0, <=7.1.1) should upgrade as soon as possible. ### Patches The problem has been patched in the following versions: [6.1.2](https://pypi.org/project/arches/6.1.2/), [6.2.1](https://pypi.org/project/arches/6.2.1/), and [7.2.0](https://pypi.org/project/arches/7.2.0/) Users are strongly urged to upgrade to the most recent relevant patch. ### Workarounds There are no workarounds. ### General References https://www.w3schools.com/sql/sql_injection.asp https://en.wikipedia.org/wiki/SQL_injection ### For more information Post any questions to the [Arches project forum](https://community.archesproject.org/).

References

External links from the advisory. They lead to third-party sites.