Medium USN-8765-1 1 CVE

python-sql vulnerability

Published Sep 15, 2026 · Updated Sep 16, 2026

Ecosystem: Ubuntu

Summary

Cédric Krier discovered that python-sql incorrectly escaped values passed
to unary operators. An attacker could possibly use this issue to perform
SQL injection attacks.

Fixed packages 5

Release	Package	Fixed in
Ubuntu · 24.04 LTS 24.04:LTS	python-sql	1.4.0-1+deb12u1build0.24.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS	python-sql	0.8-1ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS	python-sql	0.9-1ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS	python-sql	1.1.0-1ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS	python-sql	1.3.0-1ubuntu0.1~esm1

Vulnerabilities 1

Medium 6.5

CVE-2024-9774

Python-sql: python-sql unary operators does not escape non-expression

A vulnerability was found in python-sql where unary operators do not escape non-Expression.

python-sql python-sql python-sql Debian Ubuntu PyPI

Dec 27, 2024

References

report
https://ubuntu.com/security/CVE-2024-9774