CVE-2019-7164: SQL Injection
A vulnerability was found in SQLAlchemy 1.2.17. An SQL Injection when the orderby parameter can be controlled.
Upstream issue:
https://github.com/sqlalchemy/sqlalchemy/issues/4481
Upstream patch:
https://github.com/sqlalchemy/sqlalchemy/commit/30307c4616ad67c01ddae2e1e8e34fabf6028414
Other sources
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the orderby parameter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/SQLAlchemyto a version that resolves this vulnerability.Fixed in 1.2.18 - Upgrade
Upgrade
pip/SQLAlchemyto a version that resolves this vulnerability.Fixed in 1.3.0b3
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-7164?
The severity of CVE-2019-7164 is critical with a CVSS score of 9.8.
How does SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allow SQL Injection?
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
What software versions are affected by CVE-2019-7164?
The following software versions are affected by CVE-2019-7164: SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2.
How can I fix CVE-2019-7164?
To fix CVE-2019-7164, upgrade SQLAlchemy to version 1.3.0 or later.
Where can I find more information about CVE-2019-7164?
You can find more information about CVE-2019-7164 at the following links: [CVE-2019-7164](https://www.cve.org/CVERecord?id=CVE-2019-7164), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-7164), [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1678520), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2019:0981).