critique
CVE-2019-7164
python-sqlalchemy: SQL Injection when the order_by parameter can be controlled
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA. Plus basse selon Red Hat (moyenne), AlmaLinux (moyenne), Oracle (moyenne), Rocky Linux (moyenne), Ubuntu (faible).
Description
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| pip::GitHub Security Advisory pip | sqlalchemy | 1.3.0b3 |
| alma 8 | python27:2.7::python-psycopg2-doc, python27:2.7::python2-Cython, python27:2.7::python2-PyMySQL et 23 autres | 2.7.5-7.module_el8.6.0+2781+fed64c13 et 22 autres |
| debian 11 | sqlalchemy | 1.2.18+ds1-2 |
| debian 12 | sqlalchemy | 1.2.18+ds1-2 |
| debian 13 | sqlalchemy | 1.2.18+ds1-2 |
| debian 14 | sqlalchemy | 1.2.18+ds1-2 |
| debian 8 | sqlalchemy | 0.9.8+dfsg-0.1+deb8u1 |
| debian 9 | sqlalchemy | 1.0.15+ds1-1+deb9u1 |
| echo | sqlalchemy | 1.2.18+ds1-2 |
| Oracle Linux 8 | babel, python-nose-docs, python-psycopg2-doc et 74 autres | 2.5.1-9.module+el8.0.0+5233+93973c75 et 52 autres |
| Red Hat | calamari-server, python-sqlalchemy, python-sqlalchemy-doc et 4 autres | pas de correctif indiqué |
| rocky 8 | python27:2.7::babel, python27:2.7::python-psycopg2-doc, python27:2.7::python2-Cython et 34 autres | 2.5.1-9.module+el8.4.0+403+9ae17a31 et 28 autres |
Afficher les 156 entrées de 13 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| pip::GitHub Security Advisory pip | sqlalchemy | 1.3.0b3 |
| alma 8 | python27:2.7::python-psycopg2-doc | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-Cython | 0.28.1-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-PyMySQL | 0.8.0-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-attrs | 17.4.0-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-chardet | 3.0.4-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-coverage | 4.5.1-4.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-docutils | 0.14-12.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-funcsigs | 1.0.2-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-idna | 2.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-ipaddress | 1.0.18-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-markupsafe | 0.23-19.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-mock | 2.0.0-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pluggy | 0.6.0-8.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2 | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2-debug | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2-tests | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-py | 1.5.3-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pysocks | 1.6.8-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytest | 3.4.2-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytest-mock | 1.9.0-4.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytz | 2017.2-12.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pyyaml | 3.12-16.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-rpm-macros | 3-38.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-setuptools_scm | 1.15.7-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python36:3.6::python3-docs | 3.6.7-2.module_el8.5.0+135+5ce32bc4 |
| alma 8 | python36:3.6::python3-docutils | 0.14-12.module_el8.5.0+135+5ce32bc4 |
| debian 11 | sqlalchemy | 1.2.18+ds1-2 |
| debian 12 | sqlalchemy | 1.2.18+ds1-2 |
| debian 13 | sqlalchemy | 1.2.18+ds1-2 |
| debian 14 | sqlalchemy | 1.2.18+ds1-2 |
| debian 8 | sqlalchemy | 0.9.8+dfsg-0.1+deb8u1 |
| debian 9 | sqlalchemy | 1.0.15+ds1-1+deb9u1 |
| echo | sqlalchemy | 1.2.18+ds1-2 |
| Oracle Linux 8 | babel | 2.5.1-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python-nose-docs | 1.3.7-30.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python-psycopg2-doc | 2.7.5-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python-pymongo-doc | 3.6.1-9.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python-sqlalchemy-doc | 1.3.2-1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python-virtualenv-doc | 15.1.0-18.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python2 | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-Cython | 0.28.1-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-PyMySQL | 0.8.0-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-attrs | 17.4.0-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-babel | 2.5.1-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-backports | 1.0-15.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-backports-ssl_match_hostname | 3.5.0.1-11.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-bson | 3.6.1-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-chardet | 3.0.4-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-coverage | 4.5.1-4.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-debug | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-devel | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-dns | 1.15.0-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-docs | 2.7.15-4.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-docs-info | 2.7.15-4.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-docutils | 0.14-12.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-funcsigs | 1.0.2-13.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-idna | 2.5-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-ipaddress | 1.0.18-6.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-jinja2 | 2.10-8.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-libs | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-lxml | 4.2.3-3.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-markupsafe | 0.23-19.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-mock | 2.0.0-13.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-nose | 1.3.7-30.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-numpy | 1:1.14.2-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-numpy-doc | 1:1.14.2-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-numpy-f2py | 1:1.14.2-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pip | 9.0.3-13.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pluggy | 0.6.0-8.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-psycopg2 | 2.7.5-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-psycopg2-debug | 2.7.5-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-psycopg2-tests | 2.7.5-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-py | 1.5.3-6.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pygments | 2.2.0-20.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pymongo | 3.6.1-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pymongo-gridfs | 3.6.1-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pysocks | 1.6.8-6.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pytest | 3.4.2-13.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pytest-mock | 1.9.0-4.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pytz | 2017.2-12.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pyyaml | 3.12-16.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-requests | 2.20.0-2.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-rpm-macros | 3-38.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-scipy | 1.0.0-19.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-setuptools | 39.0.1-11.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-setuptools_scm | 1.15.7-6.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-six | 1.11.0-5.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-sqlalchemy | 1.3.2-1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-test | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-tkinter | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-tools | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-urllib3 | 1.23-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-virtualenv | 15.1.0-18.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-wheel | 1:0.30.0-13.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python3-PyMySQL | 0.8.0-10.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-bson | 3.6.1-9.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-docs | 3.6.7-2.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-docutils | 0.14-12.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-nose | 1.3.7-30.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-pygments | 2.2.0-20.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-pymongo | 3.6.1-9.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-pymongo-gridfs | 3.6.1-9.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-scipy | 1.0.0-19.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-sqlalchemy | 1.3.2-1.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-virtualenv | 15.1.0-18.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-wheel | 1:0.30.0-13.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python36 | 3.6.8-2.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python36-debug | 3.6.8-2.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python36-devel | 3.6.8-2.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python36-rpm-macros | 3.6.8-2.module+el8.0.0+5217+22a49f57 |
| Red Hat | calamari-server | pas de correctif indiqué |
| Red Hat | python-sqlalchemy | pas de correctif indiqué |
| Red Hat | python-sqlalchemy-doc | pas de correctif indiqué |
| Red Hat | python2-sqlalchemy | pas de correctif indiqué |
| Red Hat | python27-python-sqlalchemy | pas de correctif indiqué |
| Red Hat | rh-python35-python-sqlalchemy | pas de correctif indiqué |
| Red Hat | rh-python36-python-sqlalchemy | pas de correctif indiqué |
| rocky 8 | python27:2.7::babel | 2.5.1-9.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python-psycopg2-doc | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-Cython | 0.28.1-7.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-PyMySQL | 0.8.0-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-attrs | 17.4.0-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-babel | 2.5.1-9.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-chardet | 3.0.4-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-coverage | 4.5.1-4.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-docutils | 0.14-12.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-funcsigs | 1.0.2-13.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-idna | 2.5-7.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-ipaddress | 1.0.18-6.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-jinja2 | 2.10-8.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-markupsafe | 0.23-19.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-mock | 2.0.0-13.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-pluggy | 0.6.0-8.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-psycopg2 | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-psycopg2-debug | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-psycopg2-tests | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-py | 1.5.3-6.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pysocks | 1.6.8-6.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pytest | 3.4.2-13.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pytest-mock | 1.9.0-4.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-pytz | 2017.2-12.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pyyaml | 3.12-16.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-rpm-macros | 3-38.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-setuptools_scm | 1.15.7-6.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python36:3.6::python-nose-docs | 1.3.7-30.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python3-PyMySQL | 0.8.0-10.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python3-docs | 3.6.7-2.module+el8.4.0+597+ddf0ddea |
| rocky 8 | python36:3.6::python3-docutils | 0.14-12.module+el8.4.0+597+ddf0ddea |
| rocky 8 | python36:3.6::python3-nose | 1.3.7-30.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python3-pygments | 2.2.0-20.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python36 | 3.6.8-2.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python36-debug | 3.6.8-2.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python36-devel | 3.6.8-2.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python36-rpm-macros | 3.6.8-2.module+el8.3.0+120+426d8baf |
| ubuntu 18.04-ESM | sqlalchemy | pas de correctif indiqué |
Références
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html
- https://access.redhat.com/errata/RHSA-2019:0981
- https://access.redhat.com/errata/RHSA-2019:0984
- https://access.redhat.com/security/cve/CVE-2019-7164
- https://bugzilla.redhat.com/show_bug.cgi?id=1674059
- https://bugzilla.redhat.com/show_bug.cgi?id=1678520
Les 24 références
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7164
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7548
- https://errata.almalinux.org/8/ALSA-2019-0984.html
- https://errata.rockylinux.org/RLSA-2019:0984
- https://github.com/advisories/GHSA-887w-45rq-vxgf
- https://github.com/pypa/advisory-database/tree/main/vulns/sqlalchemy/PYSEC-2019-123.yaml
- https://github.com/sqlalchemy/sqlalchemy
- https://github.com/sqlalchemy/sqlalchemy/commit/30307c4616ad67c01ddae2e1e8e34fabf6028414
- https://github.com/sqlalchemy/sqlalchemy/issues/4481
- https://linux.oracle.com/cve/CVE-2019-7164.html
- https://linux.oracle.com/errata/ELSA-2019-0984.html
- https://lists.debian.org/debian-lts-announce/2019/03/msg00020.html
- https://lists.debian.org/debian-lts-announce/2021/11/msg00005.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-7164
- https://www.cve.org/CVERecord?id=CVE-2019-7164
- https://www.oracle.com/security-alerts/cpujan2021.html