DATABASES Signal 512
datasette 1.0a38
↗
Illustration only Photo by Peter Herrmann on Unsplash
Datasette 1.0a38 patches a SQL-injection flaw that could expose private tables when public and private tables share a database.
The vulnerability let anyone who could query a public table run arbitrary SQL and read data from private tables, bypassing the permissions system. Fixing it prevents accidental data leakage in deployments that mix visibility levels, a scenario some administrators may have. Upgrading or applying the back-ported fix is the only way to close the gap.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The bug allowed read-only access to private tables via crafted SQL on any public table.
The release disables the exploit by tightening the execute-sql permission handling.
Administrators should turn off the execute-sql permission for affected databases after upgrading.
THE CLUSTER