PYSEC-2020-24

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/asyncpg/PYSEC-2020-24.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2020-24

Aliases

Published

2020-08-12T16:15:00Z

Modified

2023-11-08T04:02:41.394352Z

Summary

[none]

Details

asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, because of access to an uninitialized pointer in the array data decoder.

References

Affected packages

PyPI / asyncpg

Package

Name: asyncpg; View open source insights on deps.dev
Purl: pkg:pypi/asyncpg

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.21.0

Affected versions

0.*

0.5.0

0.5.1

0.5.2

0.5.3

0.5.4

0.6.1

0.6.2

0.6.3

0.7.0

0.8.0

0.8.1

0.8.2

0.8.3

0.8.4

0.9.0.dev1

0.9.0

0.10.0

0.10.1

0.11.0

0.12.0

0.13.0

0.14.0

0.15.0

0.16.0

0.17.0

0.18.0

0.18.1

0.18.2

0.18.3

0.19.0

0.20.0

0.20.1

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/asyncpg/PYSEC-2020-24.yaml"