Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

arches

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.6PyPIAmendedPublished

    Arches vulnerable to execution of arbitrary SQL

    CVE-2022-41892 · GHSA-gmpq-xrxj-xh8m

    Affected
    • PyPI arches <= 6.1.1; >= 6.2.0, <= 6.2.0; >= 7.0.0, <= 7.1.1
    Fixed in
    6.2.16.1.27.2.0· Vendor fix available
    Issue
    Impact With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. Anyone running the impacted versions (<=6.1.1, 6.2.0, =7.0.0, <=7.1.1) should upgrade as soon as possible. Patches The problem has been patched in the following versions: 6.1.2, 6.2.1, and 7.2.0 Users are strongly urged to upgrade to the most recent relevant patch. Workarounds There are no workarounds. General References https://www.w3schools.com/sql/sqlinjection.asp https://en.wikipedia.org/wiki/SQLinjection For more information Post any questions to the Arches project forum.

    Recommended action: Upgrade to 7.2.0, 6.2.1 or 6.1.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →