The pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function,
    which might allow remote attackers to leverage escaping issues involving multibyte character encodings.
    (CVE-2009-2940)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function,     which might allow remote attackers to leverage escaping issues involving multibyte character encodings.
    (CVE-2009-2940)

Note that Nessus relies on the presence of the package as reported by the vendor.

It was discovered that pygresql, a PostgreSQL module for Python, was missing a function to call PQescapeStringConn(). This is needed, because PQescapeStringConn() honours the charset of the connection and prevents insufficient escaping, when certain multibyte character encodings are used. The new function is called pg_escape_string(), which takes the database connection as a first argument. The old function escape_string() has been preserved as well for backwards compatibility.

Developers using these bindings are encouraged to adjust their code to use the new function.

Steffen Joeris discovered that PyGreSQL 3.8 did not use PostgreSQL's safe string and bytea functions in its own escaping functions. As a result, applications written to use PyGreSQL's escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences. Because the safe functions require a database connection, to maintain backwards compatibility, pg.escape_string() and pg.escape_bytea() are still available, but applications will have to be adjusted to use the new pyobj.escape_string() and pyobj.escape_bytea() functions. For example, code containing :

import pg connection = pg.connect(...) escaped = pg.escape_string(untrusted_input)

should be adjusted to use :

import pg connection = pg.connect(...) escaped = connection.escape_string(untrusted_input).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
432579	SCA: security update for PyGreSQL (GHSA-xv6x-43gq-4hfj)	Tenable Cloud Security	SCA Checks	high
432579	SCA: security update for PyGreSQL (GHSA-xv6x-43gq-4hfj)	Tenable Self-Hosted Container Security	SCA Checks	high
217154	Linux Distros Unpatched Vulnerability : CVE-2009-2940	Nessus	Misc.	critical
44776	Debian DSA-1911-1 : pygresql - missing escape function	Nessus	Debian Local Security Checks	high
43108	Ubuntu 8.04 LTS / 8.10 : pygresql vulnerability (USN-870-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2009-2940

high

Tenable Plugins

high

high

critical

high

high