Ubuntu Security Notice 870-1 – Steffen Joeris discovered that PyGreSQL 3.8 did not use PostgreSQL’s safe string and bytea functions in its own escaping functions. As a result, applications written to use PyGreSQL’s escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences. Because the safe functions require a database connection, to maintain backwards compatibility, pg.escape_string() and pg.escape_bytea() are still available, but applications will have to be adjusted to use the new pyobj.escape_string() and pyobj.escape_bytea() functions. For example, code containing: import pg connection = pg.connect( ) escaped = pg.escape_string(untrusted_input) should be adjusted to use: import pg connection = pg.connect( ) escaped = connection.escape_string(untrusted_input)
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/83710/USN-870-1.txt
Source: https://packetstormsecurity.com/files/83710/Ubuntu-Security-Notice-870-1.html