Vulnerability · Published Feb 7, 2024 · Assigned by GitHub_M
CVE-2024-24811Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution
Critical 9.8
In plain English
A critical-severity SQL injection in Products.SQLAlchemyDA from zopefoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version 2.2. There is no workaround for the problem.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | products-sqlalchemyda | 2.2 | GHSA-r3jc-3qmm-w3pw |
| PyPI | products-sqlalchemyda | 2.2 | PYSEC-2026-489 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zopefoundation | Products.SQLAlchemyDA | < 2.2 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H