PT-2019-20142 · Sqlalchemy · Sqlalchemy

Published 2019-02-06 · Updated 2019-02-06

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions SQLAlchemy version 1.2.17

Description The issue allows for SQL Injection when the group by parameter can be controlled.

Recommendations For version 1.2.17, consider restricting access to the group by parameter to prevent its manipulation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

PYSEC-2019-54

Affected Products

Sqlalchemy

References · 10

• https://osv.dev/vulnerability/PYSEC-2019-54 · Vendor Advisory
• https://github.com/sqlalchemy/sqlalchemy/issues/4481#issuecomment-461204518 · Note
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html · Note
• https://access.redhat.com/errata/RHSA-2019:0984 · Note
• https://lists.debian.org/debian-lts-announce/2019/03/msg00020.html · Note
• https://access.redhat.com/errata/RHSA-2019:0981 · Note
• https://oracle.com/security-alerts/cpujan2021.html · Note
• https://github.com/no-security/sqlalchemy_test · Note
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html · Note
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html · Note