REDHAT-BUG-1674059: SQL Injection
Published Feb 8, 2019
·Updated
A vulnerability was found in SQLAlchemy 1.2.17. An SQL Injection when the groupby parameter can be controlled.
References: https://github.com/no-security/sqlalchemytest
Affected Software
1 affected component
SQLAlchemy SQLAlchemy
Event History
Feb 8, 2019
Data Sourced
via Red Hat·10:01 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of REDHAT-BUG-1674059?
The severity of REDHAT-BUG-1674059 is considered to be moderate due to the potential for SQL injection.
2
How do I fix REDHAT-BUG-1674059?
To fix REDHAT-BUG-1674059, upgrade SQLAlchemy to a version that mitigates the SQL injection vulnerability.
3
What is the impact of REDHAT-BUG-1674059 on my application?
The impact of REDHAT-BUG-1674059 can allow attackers to execute arbitrary SQL commands if the application accepts unvalidated input for the group_by parameter.
4
Which versions of SQLAlchemy are affected by REDHAT-BUG-1674059?
REDHAT-BUG-1674059 affects SQLAlchemy version 1.2.17 and potentially earlier versions.
5
Is REDHAT-BUG-1674059 a known SQL injection vulnerability?
Yes, REDHAT-BUG-1674059 is a known SQL injection vulnerability that arises from improper handling of user input in SQL queries.