Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection as user provided input is passed directly to connection.execute(...) via f-strings. Details An excerpt of the Postgres savepoint handling: In this example, we can see user input is directly passed to connection.execute without being properly escaped. All implementations of savepoints and savepoint methods directly pass this name parameter to connection.execute and are vulnerable to this. A non-exhaustive list can be found below: - Postgres - - One - - Two - - Three - Sqlite - - One - - Two - - Three Care should be given to ensuring all strings passed to connection.execute are properly escaped, regardless of how end user facing they may be. Further to this, the following method also passes user input directly to an execution context however I have been unable to abuse this functionality at the time of writing. This method also has a far lower chance of being exposed to…
Recommended action: Upgrade to 1.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. The current implementation of BaseUser.login leaks enough information to a malicious user such that they would be able to successfully generate a list of valid users on the platform. As Piccolo on it's own does not also enforce strong passwords (see here), these lists of valid accounts are likely to be used in a password spray attack with the outcome being attempted takeover of user accounts on the platform. The impact of this vulnerability is minor as it requires chaining with other attack vectors in order to gain more then simply a list of valid users on the underlying platform. The likelihood of this vulnerability is possible as it requires minimal skills to pull off especially given the underlying login functionality for Piccolo based sites is open source. Details Give…
Recommended action: Upgrade to 0.121.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.