kritisch
CVE-2019-7164
python-sqlalchemy: SQL Injection when the order_by parameter can be controlled
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA. Niedriger laut Red Hat (mittel), AlmaLinux (mittel), Oracle (mittel), Rocky Linux (mittel), Ubuntu (niedrig).
Beschreibung
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| pip::GitHub Security Advisory pip | sqlalchemy | 1.3.0b3 |
| alma 8 | python27:2.7::python-psycopg2-doc, python27:2.7::python2-Cython, python27:2.7::python2-PyMySQL und 23 weitere | 2.7.5-7.module_el8.6.0+2781+fed64c13 und 22 weitere |
| debian 11 | sqlalchemy | 1.2.18+ds1-2 |
| debian 12 | sqlalchemy | 1.2.18+ds1-2 |
| debian 13 | sqlalchemy | 1.2.18+ds1-2 |
| debian 14 | sqlalchemy | 1.2.18+ds1-2 |
| debian 8 | sqlalchemy | 0.9.8+dfsg-0.1+deb8u1 |
| debian 9 | sqlalchemy | 1.0.15+ds1-1+deb9u1 |
| echo | sqlalchemy | 1.2.18+ds1-2 |
| Oracle Linux 8 | babel, python-nose-docs, python-psycopg2-doc und 74 weitere | 2.5.1-9.module+el8.0.0+5233+93973c75 und 52 weitere |
| Red Hat | calamari-server, python-sqlalchemy, python-sqlalchemy-doc und 4 weitere | kein Fix angegeben |
| rocky 8 | python27:2.7::babel, python27:2.7::python-psycopg2-doc, python27:2.7::python2-Cython und 34 weitere | 2.5.1-9.module+el8.4.0+403+9ae17a31 und 28 weitere |
Alle 156 Einträge aus 13 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| pip::GitHub Security Advisory pip | sqlalchemy | 1.3.0b3 |
| alma 8 | python27:2.7::python-psycopg2-doc | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-Cython | 0.28.1-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-PyMySQL | 0.8.0-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-attrs | 17.4.0-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-chardet | 3.0.4-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-coverage | 4.5.1-4.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-docutils | 0.14-12.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-funcsigs | 1.0.2-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-idna | 2.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-ipaddress | 1.0.18-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-markupsafe | 0.23-19.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-mock | 2.0.0-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pluggy | 0.6.0-8.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2 | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2-debug | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2-tests | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-py | 1.5.3-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pysocks | 1.6.8-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytest | 3.4.2-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytest-mock | 1.9.0-4.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytz | 2017.2-12.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pyyaml | 3.12-16.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-rpm-macros | 3-38.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-setuptools_scm | 1.15.7-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python36:3.6::python3-docs | 3.6.7-2.module_el8.5.0+135+5ce32bc4 |
| alma 8 | python36:3.6::python3-docutils | 0.14-12.module_el8.5.0+135+5ce32bc4 |
| debian 11 | sqlalchemy | 1.2.18+ds1-2 |
| debian 12 | sqlalchemy | 1.2.18+ds1-2 |
| debian 13 | sqlalchemy | 1.2.18+ds1-2 |
| debian 14 | sqlalchemy | 1.2.18+ds1-2 |
| debian 8 | sqlalchemy | 0.9.8+dfsg-0.1+deb8u1 |
| debian 9 | sqlalchemy | 1.0.15+ds1-1+deb9u1 |
| echo | sqlalchemy | 1.2.18+ds1-2 |
| Oracle Linux 8 | babel | 2.5.1-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python-nose-docs | 1.3.7-30.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python-psycopg2-doc | 2.7.5-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python-pymongo-doc | 3.6.1-9.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python-sqlalchemy-doc | 1.3.2-1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python-virtualenv-doc | 15.1.0-18.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python2 | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-Cython | 0.28.1-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-PyMySQL | 0.8.0-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-attrs | 17.4.0-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-babel | 2.5.1-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-backports | 1.0-15.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-backports-ssl_match_hostname | 3.5.0.1-11.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-bson | 3.6.1-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-chardet | 3.0.4-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-coverage | 4.5.1-4.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-debug | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-devel | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-dns | 1.15.0-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-docs | 2.7.15-4.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-docs-info | 2.7.15-4.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-docutils | 0.14-12.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-funcsigs | 1.0.2-13.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-idna | 2.5-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-ipaddress | 1.0.18-6.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-jinja2 | 2.10-8.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-libs | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-lxml | 4.2.3-3.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-markupsafe | 0.23-19.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-mock | 2.0.0-13.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-nose | 1.3.7-30.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-numpy | 1:1.14.2-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-numpy-doc | 1:1.14.2-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-numpy-f2py | 1:1.14.2-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pip | 9.0.3-13.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pluggy | 0.6.0-8.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-psycopg2 | 2.7.5-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-psycopg2-debug | 2.7.5-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-psycopg2-tests | 2.7.5-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-py | 1.5.3-6.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pygments | 2.2.0-20.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pymongo | 3.6.1-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pymongo-gridfs | 3.6.1-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pysocks | 1.6.8-6.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pytest | 3.4.2-13.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pytest-mock | 1.9.0-4.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pytz | 2017.2-12.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pyyaml | 3.12-16.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-requests | 2.20.0-2.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-rpm-macros | 3-38.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-scipy | 1.0.0-19.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-setuptools | 39.0.1-11.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-setuptools_scm | 1.15.7-6.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-six | 1.11.0-5.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-sqlalchemy | 1.3.2-1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-test | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-tkinter | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-tools | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-urllib3 | 1.23-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-virtualenv | 15.1.0-18.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-wheel | 1:0.30.0-13.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python3-PyMySQL | 0.8.0-10.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-bson | 3.6.1-9.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-docs | 3.6.7-2.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-docutils | 0.14-12.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-nose | 1.3.7-30.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-pygments | 2.2.0-20.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-pymongo | 3.6.1-9.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-pymongo-gridfs | 3.6.1-9.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-scipy | 1.0.0-19.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-sqlalchemy | 1.3.2-1.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-virtualenv | 15.1.0-18.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-wheel | 1:0.30.0-13.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python36 | 3.6.8-2.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python36-debug | 3.6.8-2.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python36-devel | 3.6.8-2.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python36-rpm-macros | 3.6.8-2.module+el8.0.0+5217+22a49f57 |
| Red Hat | calamari-server | kein Fix angegeben |
| Red Hat | python-sqlalchemy | kein Fix angegeben |
| Red Hat | python-sqlalchemy-doc | kein Fix angegeben |
| Red Hat | python2-sqlalchemy | kein Fix angegeben |
| Red Hat | python27-python-sqlalchemy | kein Fix angegeben |
| Red Hat | rh-python35-python-sqlalchemy | kein Fix angegeben |
| Red Hat | rh-python36-python-sqlalchemy | kein Fix angegeben |
| rocky 8 | python27:2.7::babel | 2.5.1-9.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python-psycopg2-doc | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-Cython | 0.28.1-7.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-PyMySQL | 0.8.0-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-attrs | 17.4.0-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-babel | 2.5.1-9.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-chardet | 3.0.4-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-coverage | 4.5.1-4.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-docutils | 0.14-12.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-funcsigs | 1.0.2-13.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-idna | 2.5-7.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-ipaddress | 1.0.18-6.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-jinja2 | 2.10-8.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-markupsafe | 0.23-19.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-mock | 2.0.0-13.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-pluggy | 0.6.0-8.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-psycopg2 | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-psycopg2-debug | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-psycopg2-tests | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-py | 1.5.3-6.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pysocks | 1.6.8-6.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pytest | 3.4.2-13.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pytest-mock | 1.9.0-4.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-pytz | 2017.2-12.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pyyaml | 3.12-16.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-rpm-macros | 3-38.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-setuptools_scm | 1.15.7-6.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python36:3.6::python-nose-docs | 1.3.7-30.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python3-PyMySQL | 0.8.0-10.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python3-docs | 3.6.7-2.module+el8.4.0+597+ddf0ddea |
| rocky 8 | python36:3.6::python3-docutils | 0.14-12.module+el8.4.0+597+ddf0ddea |
| rocky 8 | python36:3.6::python3-nose | 1.3.7-30.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python3-pygments | 2.2.0-20.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python36 | 3.6.8-2.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python36-debug | 3.6.8-2.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python36-devel | 3.6.8-2.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python36-rpm-macros | 3.6.8-2.module+el8.3.0+120+426d8baf |
| ubuntu 18.04-ESM | sqlalchemy | kein Fix angegeben |
Referenzen
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html
- https://access.redhat.com/errata/RHSA-2019:0981
- https://access.redhat.com/errata/RHSA-2019:0984
- https://access.redhat.com/security/cve/CVE-2019-7164
- https://bugzilla.redhat.com/show_bug.cgi?id=1674059
- https://bugzilla.redhat.com/show_bug.cgi?id=1678520
Alle 24 Referenzen
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7164
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7548
- https://errata.almalinux.org/8/ALSA-2019-0984.html
- https://errata.rockylinux.org/RLSA-2019:0984
- https://github.com/advisories/GHSA-887w-45rq-vxgf
- https://github.com/pypa/advisory-database/tree/main/vulns/sqlalchemy/PYSEC-2019-123.yaml
- https://github.com/sqlalchemy/sqlalchemy
- https://github.com/sqlalchemy/sqlalchemy/commit/30307c4616ad67c01ddae2e1e8e34fabf6028414
- https://github.com/sqlalchemy/sqlalchemy/issues/4481
- https://linux.oracle.com/cve/CVE-2019-7164.html
- https://linux.oracle.com/errata/ELSA-2019-0984.html
- https://lists.debian.org/debian-lts-announce/2019/03/msg00020.html
- https://lists.debian.org/debian-lts-announce/2021/11/msg00005.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-7164
- https://www.cve.org/CVERecord?id=CVE-2019-7164
- https://www.oracle.com/security-alerts/cpujan2021.html