CVE-2019-7548: SQL Injection
A vulnerability was found in SQLAlchemy 1.2.17. An SQL Injection when the groupby parameter can be controlled.
References: https://github.com/no-security/sqlalchemytest
Other sources
SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/SQLAlchemyto a version that resolves this vulnerability.Fixed in 1.2.19
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-7548?
CVE-2019-7548 is a vulnerability in SQLAlchemy 1.2.17 that allows SQL injection when the group_by parameter can be controlled.
What is the severity of CVE-2019-7548?
CVE-2019-7548 has a severity rating of 7.8, which is considered high.
Which software versions are affected by CVE-2019-7548?
SQLAlchemy versions up to 1.2.17 are affected by CVE-2019-7548.
How do I fix CVE-2019-7548?
To fix CVE-2019-7548, update to SQLAlchemy version 1.3.0 or higher.
Where can I find more information about CVE-2019-7548?
You can find more information about CVE-2019-7548 at the following references: [link1], [link2], [link3].