CVE-2012-0805: SQL Injection
Published Jun 5, 2012
·Updated
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.
Affected Software
15 affected componentsFixes available
pip/SQLAlchemy<0.7.0b4
0.7.0b4
SQLAlchemy SQLAlchemy<=0.7.0
SQLAlchemy SQLAlchemy=0.6.0
SQLAlchemy SQLAlchemy=0.6.0-beta1
SQLAlchemy SQLAlchemy=0.6.0-beta2
SQLAlchemy SQLAlchemy=0.6.0-beta3
SQLAlchemy SQLAlchemy=0.6.1
SQLAlchemy SQLAlchemy=0.6.2
SQLAlchemy SQLAlchemy=0.6.3
SQLAlchemy SQLAlchemy=0.6.4
SQLAlchemy SQLAlchemy=0.6.5
SQLAlchemy SQLAlchemy=0.6.6
SQLAlchemy SQLAlchemy=0.6.7
SQLAlchemy SQLAlchemy=0.7.0-b1
SQLAlchemy SQLAlchemy=0.7.0-b2
Remediation
Patch Available
Event History
Jun 5, 2012
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
May 14, 2022
Advisory Published
via GitHub·03:49 AM
Frequently Asked Questions
1
What is the severity of CVE-2012-0805?
The severity of CVE-2012-0805 is considered to be high due to its potential for remote SQL command execution.
2
How do I fix CVE-2012-0805?
To fix CVE-2012-0805, update SQLAlchemy to version 0.7.0b4 or later.
3
Which versions are affected by CVE-2012-0805?
CVE-2012-0805 affects all SQLAlchemy versions prior to 0.7.0b4, including versions 0.6.0 to 0.6.7.
4
What type of vulnerability is CVE-2012-0805?
CVE-2012-0805 is classified as an SQL injection vulnerability.
5
Can CVE-2012-0805 be exploited remotely?
Yes, CVE-2012-0805 can be exploited remotely by attackers to execute arbitrary SQL commands.