PT-2019-20142 · Sqlalchemy · Sqlalchemy

Publicado 2019-02-06 · Atualizado 2019-02-06

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions SQLAlchemy version 1.2.17

Description The issue allows for SQL Injection when the group by parameter can be controlled.

Recommendations For version 1.2.17, consider restricting access to the group by parameter to prevent its manipulation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

PYSEC-2019-54

Produtos afetados

Sqlalchemy

Referências · 10

• https://github.com/sqlalchemy/sqlalchemy/issues/4481#issuecomment-461204518 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html · Nota
• https://access.redhat.com/errata/RHSA-2019:0984 · Nota
• https://lists.debian.org/debian-lts-announce/2019/03/msg00020.html · Nota
• https://access.redhat.com/errata/RHSA-2019:0981 · Nota
• https://oracle.com/security-alerts/cpujan2021.html · Nota
• https://github.com/no-security/sqlalchemy_test · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html · Nota
• https://osv.dev/vulnerability/PYSEC-2019-54 · Aviso do Fabricante