CVE-2009-2940

Name	CVE-2009-2940
Description	The pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1911-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pygresql (PTS)	jessie	1:4.0-3.1	fixed
	stretch	1:5.0.3-1	fixed
	buster	1:5.0.6-2	fixed
	bullseye	1:5.1.2-1	fixed
	bookworm	1:5.1.2-2	fixed
	sid, trixie	1:6.1.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
pygresql	source	etch	1:3.8.1-1etch2		DSA-1911-1
pygresql	source	lenny	1:3.8.1-3+lenny1		DSA-1911-1
pygresql	source	(unstable)	1:4.0-1	low