CVE-2019-7164: SQL Injection
A vulnerability was found in SQLAlchemy 1.2.17. An SQL Injection when the orderby parameter can be controlled.
Upstream issue:
https://github.com/sqlalchemy/sqlalchemy/issues/4481
Upstream patch:
https://github.com/sqlalchemy/sqlalchemy/commit/30307c4616ad67c01ddae2e1e8e34fabf6028414
Other sources
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the orderby parameter.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-7164?
The severity of CVE-2019-7164 is critical with a CVSS score of 9.8.
How does SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allow SQL Injection?
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
What software versions are affected by CVE-2019-7164?
The following software versions are affected by CVE-2019-7164: SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2.
How can I fix CVE-2019-7164?
To fix CVE-2019-7164, upgrade SQLAlchemy to version 1.3.0 or later.
Where can I find more information about CVE-2019-7164?
You can find more information about CVE-2019-7164 at the following links: [CVE-2019-7164](https://www.cve.org/CVERecord?id=CVE-2019-7164), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2019-7164), [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1678520), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2019:0981).