CVE-2016-8640 SQL Injection in pycsw
CriticalCVSS 9.1
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi pycsw(PyPI) | >= 2.0.0, < 2.0.2 | 2.0.2 |
| pypi pycsw(PyPI) | = 2.0.0 | No fix listed |
| pypi pycsw(PyPI) | = 2.0.1 | No fix listed |
| pypi pycsw(PyPI) | < 1.8.6 | 1.8.6 |
| pypi pycsw(PyPI) | = 1.4.0 | No fix listed |
| pypi pycsw(PyPI) | = 1.4.1 | No fix listed |
| pypi pycsw(PyPI) | = 1.4.2 | No fix listed |
| pypi pycsw(PyPI) | = 1.6.0 | No fix listed |
| pypi pycsw(PyPI) | = 1.6.1 | No fix listed |
| pypi pycsw(PyPI) | = 1.6.2 | No fix listed |
| pypi pycsw(PyPI) | = 1.6.3 | No fix listed |
| pypi pycsw(PyPI) | = 1.6.4 | No fix listed |
| pypi pycsw(PyPI) | = 1.8.0 | No fix listed |
| pypi pycsw(PyPI) | = 1.8.1 | No fix listed |
| pypi pycsw(PyPI) | = 1.8.2 | No fix listed |
| pypi pycsw(PyPI) | = 1.8.3 | No fix listed |
| pypi pycsw(PyPI) | = 1.8.4 | No fix listed |
| pypi pycsw(PyPI) | = 1.8.5 | No fix listed |
| pypi pycsw(PyPI) | >= 1.10.0, < 1.10.5 | 1.10.5 |
| pypi pycsw(PyPI) | = 1.10.0 | No fix listed |
| pypi pycsw(PyPI) | = 1.10.1 | No fix listed |
| pypi pycsw(PyPI) | = 1.10.2 | No fix listed |
| pypi pycsw(PyPI) | = 1.10.3 | No fix listed |
| pypi pycsw(PyPI) | = 1.10.4 | No fix listed |
| debian/pycsw(Debian:12) | < 2.0.2+dfsg-1 | 2.0.2+dfsg-1 |
Show 42 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/pycsw(Debian:12) | = 1.10.0+dfsg-1 | No fix listed |
| debian/pycsw(Debian:12) | = 1.10.1+dfsg-1 | No fix listed |
| debian/pycsw(Debian:12) | = 1.10.1+dfsg-2 | No fix listed |
| debian/pycsw(Debian:12) | = 1.10.4+dfsg-1 | No fix listed |
| debian/pycsw(Debian:12) | = 1.10.4+dfsg-2 | No fix listed |
| debian/pycsw(Debian:12) | = 2.0.0+dfsg-1 | No fix listed |
| debian/pycsw(Debian:12) | = 2.0.0+dfsg-1~exp1 | No fix listed |
| debian/pycsw(Debian:12) | = 2.0.0+dfsg-1~exp2 | No fix listed |
| debian/pycsw(Debian:12) | = 2.0.0+dfsg-1~exp3 | No fix listed |
| debian/pycsw(Debian:12) | = 2.0.0~rc1+dfsg-1~exp1 | No fix listed |
| debian/pycsw(Debian:12) | = 2.0.0~rc1+dfsg-1~exp2 | No fix listed |
| debian/pycsw(Debian:12) | = 2.0.1+dfsg-1 | No fix listed |
| debian/pycsw(Debian:13) | < 2.0.2+dfsg-1 | 2.0.2+dfsg-1 |
| debian/pycsw(Debian:13) | = 1.10.0+dfsg-1 | No fix listed |
| debian/pycsw(Debian:13) | = 1.10.1+dfsg-1 | No fix listed |
| debian/pycsw(Debian:13) | = 1.10.1+dfsg-2 | No fix listed |
| debian/pycsw(Debian:13) | = 1.10.4+dfsg-1 | No fix listed |
| debian/pycsw(Debian:13) | = 1.10.4+dfsg-2 | No fix listed |
| debian/pycsw(Debian:13) | = 2.0.0+dfsg-1 | No fix listed |
| debian/pycsw(Debian:13) | = 2.0.0+dfsg-1~exp1 | No fix listed |
| debian/pycsw(Debian:13) | = 2.0.0+dfsg-1~exp2 | No fix listed |
| debian/pycsw(Debian:13) | = 2.0.0+dfsg-1~exp3 | No fix listed |
| debian/pycsw(Debian:13) | = 2.0.0~rc1+dfsg-1~exp1 | No fix listed |
| debian/pycsw(Debian:13) | = 2.0.0~rc1+dfsg-1~exp2 | No fix listed |
| debian/pycsw(Debian:13) | = 2.0.1+dfsg-1 | No fix listed |
| debian/pycsw(Debian:14) | < 2.0.2+dfsg-1 | 2.0.2+dfsg-1 |
| debian/pycsw(Debian:14) | = 1.10.0+dfsg-1 | No fix listed |
| debian/pycsw(Debian:14) | = 1.10.1+dfsg-1 | No fix listed |
| debian/pycsw(Debian:14) | = 1.10.1+dfsg-2 | No fix listed |
| debian/pycsw(Debian:14) | = 1.10.4+dfsg-1 | No fix listed |
| debian/pycsw(Debian:14) | = 1.10.4+dfsg-2 | No fix listed |
| debian/pycsw(Debian:14) | = 2.0.0+dfsg-1 | No fix listed |
| debian/pycsw(Debian:14) | = 2.0.0+dfsg-1~exp1 | No fix listed |
| debian/pycsw(Debian:14) | = 2.0.0+dfsg-1~exp2 | No fix listed |
| debian/pycsw(Debian:14) | = 2.0.0+dfsg-1~exp3 | No fix listed |
| debian/pycsw(Debian:14) | = 2.0.0~rc1+dfsg-1~exp1 | No fix listed |
| debian/pycsw(Debian:14) | = 2.0.0~rc1+dfsg-1~exp2 | No fix listed |
| debian/pycsw(Debian:14) | = 2.0.1+dfsg-1 | No fix listed |
| pycsw | < 1.8.6 | 1.8.6 |
| pycsw | >= 1.10.0, < 1.10.5 | 1.10.5 |
| pycsw | >= 2.0.0, < 2.0.2 | 2.0.2 |
| https://github.com/geopython pycsw | = all versions before 2.0.2, 1.10.5 and 1.8.6 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com vendor-advisory
- github.com product
- github.com
- patch-diff.githubusercontent.com patch third-party-advisory
- [oss-security] 20161111 CVE-2016-8640 pycsw SQL injection issue mailing-list patch third-party-advisory
- 94302 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2016-8640 vendor-advisory