Threats tagged 'ghsa-vjr5-c9qv-hgm3'

A critical SQL injection vulnerability exists in Rucio's Oracle JSON path handling within the FilterEngine's DID search API. Authenticated users can inject arbitrary SQL via filter keys and values in the DID search endpoint when using the default json_meta plugin with Oracle backends. The vulnerability arises from unsafe string formatting of user input into raw SQL fragments without parameterization. This can lead to full database compromise including extraction of sensitive data such as authentication tokens and password hashes. The non-Oracle database backends are not affected due to safer query construction methods.