GHSA-r3jc-3qmm-w3pw

SQLAlchemyDA unauthenticated arbitrary SQL query execution

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-24811

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Products.SQLAlchemyDA	< 2.2	2.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The vulnerability allows unauthenticated execution of arbitrary SQL statements on the database the SQLAlchemyDA instance is connected to. All users are affected. ### Patches The problem has been patched in version 2.2. ### Workarounds There is no workaround. All users are urged to upgrade to version 2.2

References

External links from the advisory. They lead to third-party sites.

https://github.com/zopefoundation/Products.SQLAlchemyDA/security/advisories/GHSA-r3jc-3qmm-w3pw web
https://nvd.nist.gov/vuln/detail/CVE-2024-24811 advisory
https://github.com/zopefoundation/Products.SQLAlchemyDA/commit/e682b99f8406f20bc3f0f2c77153ed7345fd215a web
https://github.com/zopefoundation/Products.SQLAlchemyDA package