[Cinder] Bump PyMySQL to 1.1.1

[hemna]

This addresses a vulnerability in the older pymysql.

[joker-at-work]

What's in the changelog from 1.0.2 to 1.1.1? Are all the changes safe to use and compatible?

[hemna]

Release date: 2024-05-21

Warning

This release fixes a vulnerability (CVE-2024-36039). All users are recommended to update to this version.

If you can not update soon, check the input value from untrusted source has an expected type. Only dict input from untrusted source can be an attack vector.

Prohibit dict parameter for Cursor.execute(). It didn't produce valid SQL and might cause SQL injection. (CVE-2024-36039)

[joker-at-work]

So they prohibit it now and raise a TypeError - if this doesn't break Cinder now, how are we hit by that CVE?

With changelog I meant that we might want to look at what else changed that might break OpenStack, i.e. https://github.com/PyMySQL/PyMySQL/releases/tag/v1.0.3 https://github.com/PyMySQL/PyMySQL/releases/tag/v1.1.0 and https://github.com/PyMySQL/PyMySQL/releases/tag/v1.1.1
as you're not proposing to backport that one change to fix the CVE, but to bump pymysql and thus introducing at least 20 additional changes in the code.

[joker-at-work]

Additionally, I'm wondering if this is relevant when we have SQLAlchemy in between or if they would do their own escaping/transforming anyways.