CVE-2009-2940

Steffen Joeris discovered that PyGreSQL 38 did not use PostgreSQL’s safe string and bytea functions in its own escaping functions As a result, applications written to use PyGreSQL’s escaping functions are vulnerable to SQL injections when processing certain multi-byte character sequences Because the safe functions require a database connecti ...

It was discovered that pygresql, a PostgreSQL module for Python, was missing a function to call PQescapeStringConn() This is needed, because PQescapeStringConn() honours the charset of the connection and prevents insufficient escaping, when certain multibyte character encodings are used The new function is called pg_escape_string(), which takes t ...