Description
A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| https://github.com/geopython | pycsw | all versions before 2.0.2, 1.10.5 and 1.8.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pycsw | 2.0.2+dfsg-1 | — |
| Debian 13 | pycsw | 2.0.2+dfsg-1 | — |
| Debian 12 | pycsw | 2.0.2+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | pycsw | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pycsw | >= 2.0.0, < 2.0.2 | 2.0.2 | GHSA-hg4c-rgvm-964g |
| PyPI | pycsw | < 1.8.6 | 1.8.6 | GHSA-hg4c-rgvm-964g |
| PyPI | pycsw | >= 1.10.0, < 1.10.5 | 1.10.5 | GHSA-hg4c-rgvm-964g |
| PyPI | pycsw | < 1.8.6 · >= 1.10.0, < 1.10.5 · >= 2.0.0, < 2.0.2 | 1.8.6, 1.10.5, 2.0.2 | PYSEC-2018-98 |