Fluid Attacks Database

Description

SQLAlchemy vulnerable to SQL Injection via order_by parameter SQLAlchemy before 1.3.0b3 allows SQL Injection via the order_by parameter. The fix (commit 30307c4) was applied only to the main branch and was never backported to the 1.2.x release line; all 1.2.x versions remain vulnerable.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
pypi	sqlalchemy	>=0 <1.3.0b3	1.3.0b3
debian 11	sqlalchemy	>=0 <1.2.18+ds1-2	1.2.18+ds1-2
debian 12	sqlalchemy	>=0 <1.2.18+ds1-2	1.2.18+ds1-2
debian 13	sqlalchemy	>=0 <1.2.18+ds1-2	1.2.18+ds1-2
debian 14	sqlalchemy	>=0 <1.2.18+ds1-2	1.2.18+ds1-2
rpm rhel6	python-sqlalchemy	-	-
rpm rhel7	python-sqlalchemy	-	-
rpm rhel8	python36	<0:3.6.8-2.module+el8.0.0+2975+e0f02136	0:3.6.8-2.module+el8.0.0+2975+e0f02136

Aliases

1. CVE-2019-71642. NVD-2019-71643. OSV-2019-71644. OSV-DEBIAN-2019-71645. GHSA-887w-45rq-vxgf6. GCVE-2019-71647. access.redhat.com8. access.redhat.com9. lists.debian.org10. lists.debian.org11. SECURITY-TRACKER-CVE-2019-7164

References

1. https://github.com/sqlalchemy/sqlalchemy/issues/44812. https://github.com/sqlalchemy/sqlalchemy/commit/30307c4616ad67c01ddae2e1e8e34fabf60284143. https://github.com/pypa/advisory-database/tree/main/vulns/sqlalchemy/PYSEC-2019-123.yaml4. https://www.oracle.com/security-alerts/cpujan2021.html5. http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html6. http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html7. http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.