What’s Vulnerable › Vulnerabilities

CVE-2016-8640

• Severity: critical (CVSS 9.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-08-01 · updated 2026-06-17
• Weakness: CWE-89

Description

A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table in the pycsw database that the database user has access to. Also on PostgreSQL (at least) it is possible to perform updates/inserts/deletes and database modifications to any table the database user has access to.

Affected products

• https://github.com/geopython pycsw: before 1.8.6; from 1.10.0 before 1.10.5; from 2.0.0 before 2.0.2 — fixed in 1.10.5, 1.8.6, 2.0.2

How to fix

Upgrade to a fixed version: https://github.com/geopython pycsw 1.10.5, 1.8.6, 2.0.2. Check the vendor advisory for mitigations.

References

• http://seclists.org/oss-sec/2016/q4/406
• http://www.securityfocus.com/bid/94302
• https://github.com/geopython/pycsw/pull/474/files
• https://patch-diff.githubusercontent.com/raw/geopython/pycsw/pull/474.patch
• http://seclists.org/oss-sec/2016/q4/406
• http://www.securityfocus.com/bid/94302
• https://github.com/geopython/pycsw/pull/474/files
• https://patch-diff.githubusercontent.com/raw/geopython/pycsw/pull/474.patch

Get alerted when CVE-2016-8640 or the next vulnerability affects your stack