See how sqlalchemy compares to other vendors in security performance
Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.gettemplate() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.gettemplate(). This vulnerability is fixed in 1.3.11.
Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugin.
A vulnerability was found in SQLAlchemy 1.2.17. An SQL Injection when the orderby parameter can be controlled.
Upstream issue:
https://github.com/sqlalchemy/sqlalchemy/issues/4481
Upstream patch:
https://github.com/sqlalchemy/sqlalchemy/commit/30307c4616ad67c01ddae2e1e8e34fabf6028414
A vulnerability was found in SQLAlchemy 1.2.17. An SQL Injection when the groupby parameter can be controlled.
References: https://github.com/no-security/sqlalchemytest
A vulnerability was found in SQLAlchemy 1.2.17. An SQL Injection when the groupby parameter can be controlled.
References: https://github.com/no-security/sqlalchemytest
A vulnerability was found in SQLAlchemy 1.2.17. An SQL Injection when the orderby parameter can be controlled.
Upstream issue:
https://github.com/sqlalchemy/sqlalchemy/issues/4481
Upstream patch:
https://github.com/sqlalchemy/sqlalchemy/commit/30307c4616ad67c01ddae2e1e8e34fabf6028414
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.