PT-2018-5042 · Pycsw · Pycsw

Publicado 2018-08-01 · Atualizado 2019-10-09 · CVE-2016-8640

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions pycsw versions prior to 2.0.2 pycsw versions prior to 1.10.5 pycsw versions prior to 1.8.6

Description A SQL injection issue affects the pycsw database, allowing unauthorized access to read and extract data from any table that the database user has access to. On PostgreSQL, it is also possible to perform updates, inserts, deletes, and modify the database in any table the database user has access to.

Recommendations For versions prior to 2.0.2, update to version 2.0.2 or later. For versions prior to 1.10.5, update to version 1.10.5 or later. For versions prior to 1.8.6, update to version 1.8.6 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2016-8640

GHSA-HG4C-RGVM-964G

PYSEC-2018-98

Produtos afetados

Pycsw

Referências · 19

• https://github.com/geopython/pycsw/pull/474/files · Correção
• https://github.com/geopython/pycsw · Nota
• https://github.com/geopython/pycsw/commit/daaf09b4b920708a415be3c7f446739661ba3753 · Nota
• https://github.com/geopython/pycsw/commit/522873e5ce48bb9cbd4e7e8168ca881ce709c222 · Nota
• https://github.com/geopython/pycsw/commit/69546e13527c82e4f9191769215490381ad511b2 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pycsw/PYSEC-2018-98.yaml · Nota
• https://github.com/advisories/GHSA-hg4c-rgvm-964g · Nota
• https://ubuntu.com/security/CVE-2016-8640 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-8640 · Aviso do Fabricante
• https://patch-diff.githubusercontent.com/raw/geopython/pycsw/pull/474.patch · Correção
• https://osv.dev/vulnerability/GHSA-hg4c-rgvm-964g · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-8640 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2016-8640 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-8640 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-8640 · Aviso do Fabricante