{"id":"CVE-2024-36039","aliases":["ALSA-2024:4244","ALSA-2024:4245","ALSA-2024:9193","ALSA-2024:9194","AZL-43726","AZL-44457","CLSA-2026-1768435940","DEBIAN-CVE-2024-36039","DLA-3822-1","DSA-5700-1","EUVD-2024-1798","GHSA-v9hf-5j83-6xpp","OESA-2024-1719","PYSEC-2026-502","RHSA-2024:4244","RHSA-2024:4245","RHSA-2024:9193","RHSA-2024:9194","RLSA-2024:4244","RLSA-2024:4245","RLSA-2024:9193","ROOT-APP-PYPI-CVE-2024-36039","SUSE-SU-2024:1855-1","SUSE-SU-2024:1925-1","UBUNTU-CVE-2024-36039","USN-6801-1","openSUSE-SU-2024:13993-1","openSUSE-SU-2026:11995-1"],"status":"published","title":"PyMySQL SQL Injection vulnerability","description":"PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00691,"percentile":0.53095,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-89"],"published":"2024-05-21T00:00:00Z","modified":"2026-11-02T12:02:34Z","exploits":[{"source":"pocgithub","id":"zenniskayy2k4/CVE-2024-36039_PoC","title":"zenniskayy2k4/CVE-2024-36039_PoC","date":"2026-03-26","url":"https://github.com/zenniskayy2k4/CVE-2024-36039_PoC"}],"fixes":[{"ecosystem":"PyPI","package":"pymysql","fixed_in":["1.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:8","package":"python3.11-PyMySQL","fixed_in":["1.0.2-2.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"python3.12-PyMySQL","fixed_in":["1.1.0-3.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"python3.12-PyMySQL","fixed_in":["1.1.0-3.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"python3.12-PyMySQL+rsa","fixed_in":["1.1.0-3.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"python3.11-PyMySQL","fixed_in":["1.0.2-2.el9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"python3.11-PyMySQL+rsa","fixed_in":["1.0.2-2.el9"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-PyMySQL","fixed_in":["1.1.1-3"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"pymysql","fixed_in":["0.10.1.post1+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-pymysql","fixed_in":["1.0.2-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-pymysql","fixed_in":["1.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-pymysql","fixed_in":["1.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"python-pymysql","fixed_in":["0.9.3-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"python-pymysql","fixed_in":["0.9.3-2+deb11u1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-PyMySQL","fixed_in":["0.9.2-4.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"python-PyMySQL","fixed_in":["0.9.3-4.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-PyMySQL","fixed_in":["0.9.3-4.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-PyMySQL","fixed_in":["1.1.0-2.oe2403"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3.11-PyMySQL","fixed_in":["0:1.0.2-2.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3.12-PyMySQL","fixed_in":["0:1.1.0-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.12-PyMySQL+rsa","fixed_in":["0:1.1.0-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.12-PyMySQL","fixed_in":["0:1.1.0-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.11-PyMySQL+rsa","fixed_in":["0:1.0.2-2.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.11-PyMySQL","fixed_in":["0:1.0.2-2.el9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"python3.11-PyMySQL","fixed_in":["0:1.0.2-2.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"python3.12-PyMySQL","fixed_in":["0:1.1.0-3.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"python3.12-PyMySQL","fixed_in":["0:1.1.0-3.el9"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"rootio-PyMySQL","fixed_in":["1.1.0+root.io.1","1.1.0+root.io.2"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"PyMySQL","fixed_in":["1.1.0+aikido.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"python-PyMySQL","fixed_in":["0.7.11-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"python-PyMySQL","fixed_in":["0.7.11-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"python-PyMySQL","fixed_in":["0.7.11-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python-PyMySQL","fixed_in":["1.1.0-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"python-pymysql","fixed_in":["0.9.3-2ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-pymysql","fixed_in":["1.0.2-1ubuntu1.22.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-pymysql","fixed_in":["1.0.2-2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-PyMySQL","fixed_in":["1.2.0-1.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3.11-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3.12-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-3.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.12-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-3.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.12-PyMySQL+rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-3.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.11-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2.el9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.11-PyMySQL+rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2.el9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.9.3-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-3"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10.1"},{"fixed":"0.10.1.post1+tuxcare"}]}],"versions":["0.10.1"]},{"source":"osv","ecosystem":"Debian:12","package":"python-pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2+deb12u1"}]}],"versions":["1.0.2-2"]},{"source":"osv","ecosystem":"Debian:13","package":"python-pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"python-pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-1+deb10u1"}]}],"versions":["0.9.3-1"]},{"source":"osv","ecosystem":"Debian:11","package":"python-pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2+deb11u1"}]}],"versions":["0.9.3-2"]},{"source":"osv","ecosystem":"Debian:12","package":"python-pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2+deb12u1"}]}],"versions":["1.0.2-2"]},{"source":"osv","ecosystem":"PyPI","package":"pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}],"versions":["0.10.0","0.10.1","0.2","0.3","0.4","0.5","0.6","0.6.1","0.6.2","0.6.2-rc1","0.6.3","0.6.4","0.6.4.dev1","0.6.5","0.6.6","0.6.7","0.7.0","0.7.1","0.7.10","0.7.11","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.7.9","0.8.0","0.8.1","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.3rc1","1.1.0","1.1.0rc1","1.1.0rc2"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.2-4.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-4.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-4.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-2.oe2403"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1"}]}],"versions":["0.10.0","0.10.1","0.2","0.3","0.4","0.5","0.6","0.6.1","0.6.2","0.6.2-rc1","0.6.3","0.6.4","0.6.4.dev1","0.6.5","0.6.6","0.6.7","0.7.0","0.7.1","0.7.10","0.7.11","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.7.9","0.8.0","0.8.1","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.1","1.0.2","1.0.3","1.0.3rc1","1.1.0","1.1.0rc1","1.1.0rc2"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3.11-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3.12-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.12-PyMySQL+rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.12-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.11-PyMySQL+rsa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.11-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"python3.11-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-2.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"python3.12-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-3.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"python3.12-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.0-3.el9"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0+root.io.1"},{"fixed":"1.1.0+root.io.2"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0+aikido.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"python-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.11-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"python-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.11-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"python-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.11-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.2-2","0.7.2-1","0.7.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.11-1","0.8.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu3.1"}]}],"versions":["0.9.3-1","0.9.3-2ubuntu1","0.9.3-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-1ubuntu1.22.04.1"}]}],"versions":["1.0.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2ubuntu1.1"}]}],"versions":["1.0.2-1ubuntu1","1.0.2-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3-2ubuntu3.1"}]}],"versions":["0.9.3-1","0.9.3-2ubuntu1","0.9.3-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-1ubuntu1.22.04.1"}]}],"versions":["1.0.2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-pymysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2ubuntu1.1"}]}],"versions":["1.0.2-1ubuntu1","1.0.2-2ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-PyMySQL","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1.2"}]}]}],"references":[{"url":"https://github.com/PyMySQL/PyMySQL/releases/tag/v1.1.1","tags":["x_transferred","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/05/msg00017.html","tags":["mailing-list","x_transferred","article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35VOJS3SRJNLQIO7YTZFNM6RWHIHWTMK/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/23VXBV34GFRICCVYZ6KFMSSWY5UEXCF5/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36039","tags":["web","advisory"]},{"url":"https://github.com/PyMySQL/PyMySQL/commit/521e40050cb386a499f68f483fefd144c493053c","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35VOJS3SRJNLQIO7YTZFNM6RWHIHWTMK","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/23VXBV34GFRICCVYZ6KFMSSWY5UEXCF5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v9hf-5j83-6xpp","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4244","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-36039","tags":["report"]},{"url":"https://bugzilla.redhat.com/2282821","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-4244.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4245","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-4245.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9193","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9193.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9194","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9194.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36039.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-36039","tags":["advisory"]},{"url":"https://github.com/PyMySQL/PyMySQL","tags":["package"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1719","tags":["advisory"]},{"url":"https://pypi.org/project/pymysql","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2282821","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4244.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-36039","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4245.json","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9193.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9194.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:4244","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:4245","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9193","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241855-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1225070","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36039","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241925-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-36039","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6801-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-36039","description":"PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.","status":"published","published":"2024-05-21T00:00:00Z","modified":"2024-11-21T15:27:54.677Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:14.985673Z"}],"euvd":[{"id":"EUVD-2024-1798","description":"PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.","status":"published","published":"2024-05-21T00:00:00Z","modified":"2024-11-21T15:27:54Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:52.909214Z"}],"ghsa":[{"id":"GHSA-v9hf-5j83-6xpp","title":"PyMySQL SQL Injection vulnerability","description":"PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by `escape_dict`.","status":"published","published":"2024-05-21T18:31:23Z","modified":"2024-06-24T09:30:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:55.455438Z"}],"nvd":[{"id":"CVE-2024-36039","description":"PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.","status":"published","published":"2024-05-21T16:15:26.293Z","modified":"2026-06-17T07:36:00.78Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:10:01.327642Z"}],"osv":[{"id":"CVE-2024-36039","description":"PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.","status":"published","published":"2024-05-21T00:00:00Z","modified":"2026-10-28T02:31:10.311808653Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:40.704083Z"},{"id":"DEBIAN-CVE-2024-36039","description":"PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.","status":"published","published":"2024-05-21T16:15:26.293Z","modified":"2026-11-02T12:02:34.793884077Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:42.835825Z"},{"id":"GHSA-v9hf-5j83-6xpp","title":"PyMySQL SQL Injection vulnerability","description":"PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by `escape_dict`.","status":"published","published":"2024-05-21T18:31:23Z","modified":"2026-09-10T03:50:14.333220721Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:56.981655Z"},{"id":"OESA-2024-1719","title":"python-PyMySQL security update","description":"This package contains a pure-Python MySQL client library, based on PEP 249. Most public APIs are compatible with mysqlclient and MySQLdb.\r\n\r\nSecurity Fix(es):\r\n\r\nPyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.(CVE-2024-36039)","status":"published","published":"2024-06-14T11:07:11Z","modified":"2026-08-18T01:17:24.294395326Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"PYSEC-2026-502","title":"PyMySQL SQL Injection vulnerability","description":"PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by `escape_dict`.","status":"published","published":"2026-06-29T11:50:39.950131Z","modified":"2026-07-01T20:23:03.004299Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"RHSA-2024:4244","title":"Red Hat Security Advisory: python3.11-PyMySQL security update","status":"published","published":"2024-09-14T00:16:59Z","modified":"2026-08-08T10:05:17Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:4245","title":"Red Hat Security Advisory: python3 security update","status":"published","published":"2024-09-14T00:17:07Z","modified":"2026-08-08T10:05:18Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"RHSA-2024:9193","title":"Red Hat Security Advisory: python3.12-PyMySQL security update","status":"published","published":"2024-11-13T21:19:08Z","modified":"2026-08-08T10:06:18Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:9194","title":"Red Hat Security Advisory: python3.11-PyMySQL security update","status":"published","published":"2024-11-13T21:19:18Z","modified":"2026-08-08T10:06:18Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RLSA-2024:4244","title":"Moderate: python3.11-PyMySQL security update","description":"This package contains a pure-Python MySQL client library. The goal of PyMySQL is to be a drop-in replacement for MySQLdb and work on CPython, PyPy, IronPython and Jython.\n\nSecurity Fix(es):\n\n* python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.","status":"published","published":"2025-05-07T19:11:47.341314Z","modified":"2025-05-07T20:08:47.152932Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:4245","title":"Moderate: python3 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-05-07T19:11:47.341314Z","modified":"2025-05-07T20:08:47.212408Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:9193","title":"Moderate: python3.12-PyMySQL security update","description":"This package contains a pure-Python MySQL client library. The goal of PyMySQL is to be a drop-in replacement for MySQLdb and work on CPython, PyPy, IronPython and Jython.\n\nSecurity Fix(es):\n\n* python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.","status":"published","published":"2025-03-17T20:16:49.937392Z","modified":"2025-10-09T06:18:56.700315Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2024-36039","description":"PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.","status":"published","published":"2024-05-21T16:15:00Z","modified":"2026-02-04T04:31:55.629509Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:50.784131Z"},{"id":"ALSA-2024:4244","title":"Moderate: python3.11-PyMySQL security update","description":"This package contains a pure-Python MySQL client library. The goal of PyMySQL is to be a drop-in replacement for MySQLdb and work on CPython, PyPy, IronPython and Jython.\n\nSecurity Fix(es):\n\n* python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.","status":"published","published":"2024-07-02T00:00:00Z","modified":"2026-10-29T11:02:21.432659199Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:4245","title":"Moderate: python3 security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-07-02T00:00:00Z","modified":"2026-10-29T11:02:21.340494074Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:9193","title":"Moderate: python3.12-PyMySQL security update","description":"This package contains a pure-Python MySQL client library. The goal of PyMySQL is to be a drop-in replacement for MySQLdb and work on CPython, PyPy, IronPython and Jython.  \n\nSecurity Fix(es):  \n\n  * python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:09.342411469Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2024:9194","title":"Moderate: python3.11-PyMySQL security update","description":"This package contains a pure-Python MySQL client library. The goal of PyMySQL is to be a drop-in replacement for MySQLdb and work on CPython, PyPy, IronPython and Jython.  \n\nSecurity Fix(es):  \n\n  * python-pymysql: SQL injection if used with untrusted JSON input (CVE-2024-36039)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  \n\nAdditional Changes:  \n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:09.685147259Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"AZL-43726","title":"CVE-2024-36039 affecting package python-PyMySQL 0.9.3-3","description":"PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.","status":"published","published":"2024-05-21T16:15:26Z","modified":"2026-04-21T04:31:08.068492Z","updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44457","title":"CVE-2024-36039 affecting package python-PyMySQL for versions less than 1.1.1-3","description":"PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.","status":"published","published":"2024-05-21T16:15:26Z","modified":"2026-04-21T04:51:40.416698Z","updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"CLSA-2026-1768435940","title":"TuxCare security update for pymysql (1 CVE)","description":"TuxCare rebuilt pymysql to address 1 CVE. Fixed in 0.10.1.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:09Z","modified":"2026-10-15T09:47:42.03439287Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"DLA-3822-1","title":"python-pymysql - security update","status":"published","published":"2024-05-27T00:00:00Z","modified":"2026-03-09T01:23:34.958463Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5700-1","title":"python-pymysql - security update","status":"published","published":"2024-05-29T00:00:00Z","modified":"2026-03-09T02:11:02.528294Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2024:13993-1","title":"python310-PyMySQL-1.1.1-1.1 on GA media","description":"These are all security issues fixed in the python310-PyMySQL-1.1.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:24:38.708225Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11995-1","title":"python313-PyMySQL-1.2.0-1.2 on GA media","description":"These are all security issues fixed in the python313-PyMySQL-1.2.0-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-04T00:00:00Z","modified":"2026-10-05T10:15:21.57054164Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"ROOT-APP-PYPI-CVE-2024-36039","title":"CVE-2024-36039 in rootio-PyMySQL - Patched by Root","description":"Root has patched CVE-2024-36039 in the rootio-PyMySQL package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-06-03T18:54:08Z","modified":"2026-06-04T02:00:22.548606733Z","updated_at":"2026-11-02T15:53:27.940619Z"},{"id":"SUSE-SU-2024:1855-1","title":"Security update for python-PyMySQL","description":"This update for python-PyMySQL fixes the following issues:\n\n- CVE-2024-36039: Fixed SQL injection if used with untrusted JSON input (bsc#1225070).\n","status":"published","published":"2024-05-30T12:11:59Z","modified":"2026-02-04T03:55:46.6407Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1925-1","title":"Security update for python-PyMySQL","description":"This update for python-PyMySQL fixes the following issues:\n\n- CVE-2024-36039: Fixed SQL injection when used with untrusted JSON input (bsc#1225070).\n","status":"published","published":"2024-06-05T11:51:49Z","modified":"2026-02-04T02:30:25.910584Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-6801-1","title":"python-pymysql vulnerability","description":"It was discovered that PyMySQL incorrectly escaped untrusted JSON input. An\nattacker could possibly use this issue to perform SQL injection attacks.\n","status":"published","published":"2024-05-30T11:38:31Z","modified":"2026-04-27T17:14:27.077679Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}