CVE-2019-7548

Published: Feb 6, 2019Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.

Affected (16)

Products: Sqlalchemy: Sqlalchemy · Debian: Debian Linux · Opensuse: Backports Sle, Leap · +2 more

Show all products

Sqlalchemy: Sqlalchemy · Debian: Debian Linux · Opensuse: Backports Sle, Leap · Redhat: Enterprise Linux, Enterprise Linux Eus, Enterprise Linux Server Aus, Enterprise Linux Server Tus · Oracle: Communications Operations Monitor

1 product

1 product

2 products

4 products

Enterprise Linux

Enterprise Linux Eus

Enterprise Linux Server Aus

Enterprise Linux Server Tus

1 product

Communications Operations Monitor

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Sqlalchemy Sqlalchemy	Version 1.2.17

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Backports Sle	Version 15.0
Opensuse Leap	Version 15.0
Opensuse Leap	Version 15.1

Configuration D

8 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux Eus	Version 8.1
Redhat Enterprise Linux Eus	Version 8.2
Redhat Enterprise Linux Eus	Version 8.4
Redhat Enterprise Linux Server Aus	Version 8.2
Redhat Enterprise Linux Server Aus	Version 8.4
Redhat Enterprise Linux Server Tus	Version 8.2
Redhat Enterprise Linux Server Tus	Version 8.4

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Operations Monitor	Version 4.2
Oracle Communications Operations Monitor	Version 4.3

Related CWEs

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (20)

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2019:0981

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0984

Source: cve@mitre.org

Third Party Advisory

https://github.com/no-security/sqlalchemy_test

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/sqlalchemy/sqlalchemy/issues/4481#issuecomment-461204518

Source: cve@mitre.org

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2019/03/msg00020.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/11/msg00005.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: cve@mitre.org

PatchThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2019:0981

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0984

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/no-security/sqlalchemy_test

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://github.com/sqlalchemy/sqlalchemy/issues/4481#issuecomment-461204518

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2019/03/msg00020.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/11/msg00005.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.