# Security Release for issue #92

**URL:** https://discuss.tryton.org/t/security-release-for-issue-92/7330
**Category:** News
**Tags:** security, python-sql
**Created:** [June 10, 2024, 8:00am UTC](https://discuss.tryton.org/t/security-release-for-issue-92/7330 "2024-06-10T08:00:14Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![nicoe](https://discuss-cdn.tryton.org/user_avatar/discuss.tryton.org/nicoe/32/2880_2.png) [@nicoe](https://discuss.tryton.org/u/nicoe)
#### Post date: [June 10, 2024, 8:00am UTC](https://discuss.tryton.org/t/security-release-for-issue-92/7330/1 "2024-06-10T08:00:14Z")

</div>

[Ashish Kunwar](https://foss.heptapod.net/dorkerdevil) has found that [python-sql](https://code.tryton.org/python-sql) [accepts any string in the `offset` or `limit` parameters when python is ran with `-O`](https://bugs.tryton.org/python-sql/92) which makes any system exposing those vulnerable to an SQL injection attack.

## Impact

[CVSS v3.0 Base Score: 9.1](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L/E:F/RL:O/RC:C/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:N/MI:N/MA:N)

- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Confidentiality: High
- Integrity: Low
- Availability: Low

## Workaround

Do not use the [`-O` switch or `PYTHONOPTIMIZE`](https://docs.python.org/3/using/cmdline.html#envvar-PYTHONOPTIMIZE) environment variable when executing python.

## Resolution

All affected users should upgrade `python-sql` to the latest version.

Affected versions: \<= 1.5.0  
Non affected versions: \>= 1.5.1

## Reference

- [SQL Injection vulnerability via offset parameter (#92) · Issues · Tryton / python-sql · GitLab](https://bugs.tryton.org/python-sql/92)

## Concerns?

Any security concerns should be reported on the bug-tracker at [https://bugs.tryton.org/python-sql](https://bugs.tryton.org/python-sql) with the confidential checkbox checked.

---

<div class="post-metadata">

### Author: ![system](https://discuss-cdn.tryton.org/uploads/default/original/1X/c6f8ec0a40525cdcd50058c734283450a4b3d38b.png) [@system](https://discuss.tryton.org/u/system)
#### Post date: [July 10, 2024, 8:01am UTC](https://discuss.tryton.org/t/security-release-for-issue-92/7330/2 "2024-07-10T08:01:09Z")

</div>

This topic was automatically closed after 30 days. New replies are no longer allowed.