CVE-2012-0805: SQL Injection
First published: Tue Jun 05 2012(Updated: )
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/SQLAlchemy | <0.7.0b4 | 0.7.0b4 |
| SQLAlchemy | <=0.7.0 | |
| SQLAlchemy | =0.6.0 | |
| SQLAlchemy | =0.6.0-beta1 | |
| SQLAlchemy | =0.6.0-beta2 | |
| SQLAlchemy | =0.6.0-beta3 | |
| SQLAlchemy | =0.6.1 | |
| SQLAlchemy | =0.6.2 | |
| SQLAlchemy | =0.6.3 | |
| SQLAlchemy | =0.6.4 | |
| SQLAlchemy | =0.6.5 | |
| SQLAlchemy | =0.6.6 | |
| SQLAlchemy | =0.6.7 | |
| SQLAlchemy | =0.7.0-b1 | |
| SQLAlchemy | =0.7.0-b2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://rhn.redhat.com/errata/RHSA-2012-0369.html
- http://secunia.com/advisories/48327
- http://secunia.com/advisories/48328
- http://secunia.com/advisories/48771
- http://www.debian.org/security/2012/dsa-2449
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:059
- http://www.sqlalchemy.org/changelog/CHANGES_0_7_0
- http://www.sqlalchemy.org/trac/changeset/852b6a1a87e7/
- https://bugs.launchpad.net/keystone/+bug/918608
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73756
- https://nvd.nist.gov/vuln/detail/CVE-2012-0805
- https://github.com/sqlalchemy/sqlalchemy/commit/51fea2e159ca93daa0bc8066a5c35d8436d99418
- https://web.archive.org/web/20140721183117/http://secunia.com/advisories/48771
- https://web.archive.org/web/20140802043526/http://secunia.com/advisories/48328
- https://web.archive.org/web/20140802044957/http://secunia.com/advisories/48327
- http://www.sqlalchemy.org/trac/changeset/852b6a1a87e7
- https://github.com/advisories/GHSA-hfg2-wf6j-x53p (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/sqlalchemy/PYSEC-2012-9.yaml
Frequently Asked Questions
What is the severity of CVE-2012-0805?
The severity of CVE-2012-0805 is considered to be high due to its potential for remote SQL command execution.
How do I fix CVE-2012-0805?
To fix CVE-2012-0805, update SQLAlchemy to version 0.7.0b4 or later.
Which versions are affected by CVE-2012-0805?
CVE-2012-0805 affects all SQLAlchemy versions prior to 0.7.0b4, including versions 0.6.0 to 0.6.7.
What type of vulnerability is CVE-2012-0805?
CVE-2012-0805 is classified as an SQL injection vulnerability.
Can CVE-2012-0805 be exploited remotely?
Yes, CVE-2012-0805 can be exploited remotely by attackers to execute arbitrary SQL commands.
- agent/type
- agent/weakness
- agent/remedy
- agent/softwarecombine
- agent/description
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-hfg2-wf6j-x53p
- alias/CVE-2012-0805
- agent/software-canonical-lookup
- agent/severity
- agent/last-modified-date
- agent/references
- collector/github-advisory
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- package-manager/pip
- vendor/sqlalchemy
- canonical/sqlalchemy
- version/sqlalchemy/0.7.0
- version/sqlalchemy/0.6.0
- version/sqlalchemy/0.6.0-beta1
- version/sqlalchemy/0.6.0-beta2
- version/sqlalchemy/0.6.0-beta3
- version/sqlalchemy/0.6.1
- version/sqlalchemy/0.6.2
- version/sqlalchemy/0.6.3
- version/sqlalchemy/0.6.4
- version/sqlalchemy/0.6.5
- version/sqlalchemy/0.6.6
- version/sqlalchemy/0.6.7
- version/sqlalchemy/0.7.0-b1
- version/sqlalchemy/0.7.0-b2