kritik
CVE-2019-7164
python-sqlalchemy: SQL Injection when the order_by parameter can be controlled
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA. Daha düşük diyenler: Red Hat (orta), AlmaLinux (orta), Oracle (orta), Rocky Linux (orta), Ubuntu (düşük).
Açıklama
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| pip::GitHub Security Advisory pip | sqlalchemy | 1.3.0b3 |
| alma 8 | python27:2.7::python-psycopg2-doc, python27:2.7::python2-Cython, python27:2.7::python2-PyMySQL ve 23 tane daha | 2.7.5-7.module_el8.6.0+2781+fed64c13 ve 22 tane daha |
| debian 11 | sqlalchemy | 1.2.18+ds1-2 |
| debian 12 | sqlalchemy | 1.2.18+ds1-2 |
| debian 13 | sqlalchemy | 1.2.18+ds1-2 |
| debian 14 | sqlalchemy | 1.2.18+ds1-2 |
| debian 8 | sqlalchemy | 0.9.8+dfsg-0.1+deb8u1 |
| debian 9 | sqlalchemy | 1.0.15+ds1-1+deb9u1 |
| echo | sqlalchemy | 1.2.18+ds1-2 |
| Oracle Linux 8 | babel, python-nose-docs, python-psycopg2-doc ve 74 tane daha | 2.5.1-9.module+el8.0.0+5233+93973c75 ve 52 tane daha |
| Red Hat | calamari-server, python-sqlalchemy, python-sqlalchemy-doc ve 4 tane daha | düzeltme belirtilmemiş |
| rocky 8 | python27:2.7::babel, python27:2.7::python-psycopg2-doc, python27:2.7::python2-Cython ve 34 tane daha | 2.5.1-9.module+el8.4.0+403+9ae17a31 ve 28 tane daha |
13 kaynaktaki 156 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| pip::GitHub Security Advisory pip | sqlalchemy | 1.3.0b3 |
| alma 8 | python27:2.7::python-psycopg2-doc | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-Cython | 0.28.1-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-PyMySQL | 0.8.0-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-attrs | 17.4.0-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-chardet | 3.0.4-10.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-coverage | 4.5.1-4.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-docutils | 0.14-12.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-funcsigs | 1.0.2-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-idna | 2.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-ipaddress | 1.0.18-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-markupsafe | 0.23-19.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-mock | 2.0.0-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pluggy | 0.6.0-8.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2 | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2-debug | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-psycopg2-tests | 2.7.5-7.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-py | 1.5.3-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pysocks | 1.6.8-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytest | 3.4.2-13.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytest-mock | 1.9.0-4.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pytz | 2017.2-12.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-pyyaml | 3.12-16.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-rpm-macros | 3-38.module_el8.6.0+2781+fed64c13 |
| alma 8 | python27:2.7::python2-setuptools_scm | 1.15.7-6.module_el8.6.0+2781+fed64c13 |
| alma 8 | python36:3.6::python3-docs | 3.6.7-2.module_el8.5.0+135+5ce32bc4 |
| alma 8 | python36:3.6::python3-docutils | 0.14-12.module_el8.5.0+135+5ce32bc4 |
| debian 11 | sqlalchemy | 1.2.18+ds1-2 |
| debian 12 | sqlalchemy | 1.2.18+ds1-2 |
| debian 13 | sqlalchemy | 1.2.18+ds1-2 |
| debian 14 | sqlalchemy | 1.2.18+ds1-2 |
| debian 8 | sqlalchemy | 0.9.8+dfsg-0.1+deb8u1 |
| debian 9 | sqlalchemy | 1.0.15+ds1-1+deb9u1 |
| echo | sqlalchemy | 1.2.18+ds1-2 |
| Oracle Linux 8 | babel | 2.5.1-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python-nose-docs | 1.3.7-30.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python-psycopg2-doc | 2.7.5-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python-pymongo-doc | 3.6.1-9.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python-sqlalchemy-doc | 1.3.2-1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python-virtualenv-doc | 15.1.0-18.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python2 | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-Cython | 0.28.1-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-PyMySQL | 0.8.0-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-attrs | 17.4.0-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-babel | 2.5.1-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-backports | 1.0-15.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-backports-ssl_match_hostname | 3.5.0.1-11.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-bson | 3.6.1-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-chardet | 3.0.4-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-coverage | 4.5.1-4.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-debug | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-devel | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-dns | 1.15.0-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-docs | 2.7.15-4.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-docs-info | 2.7.15-4.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-docutils | 0.14-12.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-funcsigs | 1.0.2-13.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-idna | 2.5-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-ipaddress | 1.0.18-6.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-jinja2 | 2.10-8.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-libs | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-lxml | 4.2.3-3.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-markupsafe | 0.23-19.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-mock | 2.0.0-13.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-nose | 1.3.7-30.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-numpy | 1:1.14.2-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-numpy-doc | 1:1.14.2-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-numpy-f2py | 1:1.14.2-10.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pip | 9.0.3-13.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pluggy | 0.6.0-8.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-psycopg2 | 2.7.5-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-psycopg2-debug | 2.7.5-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-psycopg2-tests | 2.7.5-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-py | 1.5.3-6.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pygments | 2.2.0-20.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pymongo | 3.6.1-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pymongo-gridfs | 3.6.1-9.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pysocks | 1.6.8-6.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pytest | 3.4.2-13.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pytest-mock | 1.9.0-4.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pytz | 2017.2-12.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-pyyaml | 3.12-16.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-requests | 2.20.0-2.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-rpm-macros | 3-38.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-scipy | 1.0.0-19.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-setuptools | 39.0.1-11.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-setuptools_scm | 1.15.7-6.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-six | 1.11.0-5.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-sqlalchemy | 1.3.2-1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-test | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-tkinter | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-tools | 2.7.15-22.0.1.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-urllib3 | 1.23-7.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-virtualenv | 15.1.0-18.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python2-wheel | 1:0.30.0-13.module+el8.0.0+5233+93973c75 |
| Oracle Linux 8 | python3-PyMySQL | 0.8.0-10.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-bson | 3.6.1-9.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-docs | 3.6.7-2.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-docutils | 0.14-12.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-nose | 1.3.7-30.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-pygments | 2.2.0-20.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-pymongo | 3.6.1-9.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-pymongo-gridfs | 3.6.1-9.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-scipy | 1.0.0-19.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-sqlalchemy | 1.3.2-1.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-virtualenv | 15.1.0-18.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python3-wheel | 1:0.30.0-13.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python36 | 3.6.8-2.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python36-debug | 3.6.8-2.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python36-devel | 3.6.8-2.module+el8.0.0+5217+22a49f57 |
| Oracle Linux 8 | python36-rpm-macros | 3.6.8-2.module+el8.0.0+5217+22a49f57 |
| Red Hat | calamari-server | düzeltme belirtilmemiş |
| Red Hat | python-sqlalchemy | düzeltme belirtilmemiş |
| Red Hat | python-sqlalchemy-doc | düzeltme belirtilmemiş |
| Red Hat | python2-sqlalchemy | düzeltme belirtilmemiş |
| Red Hat | python27-python-sqlalchemy | düzeltme belirtilmemiş |
| Red Hat | rh-python35-python-sqlalchemy | düzeltme belirtilmemiş |
| Red Hat | rh-python36-python-sqlalchemy | düzeltme belirtilmemiş |
| rocky 8 | python27:2.7::babel | 2.5.1-9.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python-psycopg2-doc | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-Cython | 0.28.1-7.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-PyMySQL | 0.8.0-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-attrs | 17.4.0-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-babel | 2.5.1-9.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-chardet | 3.0.4-10.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-coverage | 4.5.1-4.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-docutils | 0.14-12.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-funcsigs | 1.0.2-13.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-idna | 2.5-7.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-ipaddress | 1.0.18-6.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-jinja2 | 2.10-8.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-markupsafe | 0.23-19.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-mock | 2.0.0-13.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-pluggy | 0.6.0-8.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-psycopg2 | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-psycopg2-debug | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-psycopg2-tests | 2.7.5-7.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-py | 1.5.3-6.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pysocks | 1.6.8-6.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pytest | 3.4.2-13.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pytest-mock | 1.9.0-4.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-pytz | 2017.2-12.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-pyyaml | 3.12-16.module+el8.5.0+706+735ec4b3 |
| rocky 8 | python27:2.7::python2-rpm-macros | 3-38.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python27:2.7::python2-setuptools_scm | 1.15.7-6.module+el8.4.0+403+9ae17a31 |
| rocky 8 | python36:3.6::python-nose-docs | 1.3.7-30.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python3-PyMySQL | 0.8.0-10.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python3-docs | 3.6.7-2.module+el8.4.0+597+ddf0ddea |
| rocky 8 | python36:3.6::python3-docutils | 0.14-12.module+el8.4.0+597+ddf0ddea |
| rocky 8 | python36:3.6::python3-nose | 1.3.7-30.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python3-pygments | 2.2.0-20.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python36 | 3.6.8-2.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python36-debug | 3.6.8-2.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python36-devel | 3.6.8-2.module+el8.3.0+120+426d8baf |
| rocky 8 | python36:3.6::python36-rpm-macros | 3.6.8-2.module+el8.3.0+120+426d8baf |
| ubuntu 18.04-ESM | sqlalchemy | düzeltme belirtilmemiş |
Referanslar
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html
- https://access.redhat.com/errata/RHSA-2019:0981
- https://access.redhat.com/errata/RHSA-2019:0984
- https://access.redhat.com/security/cve/CVE-2019-7164
- https://bugzilla.redhat.com/show_bug.cgi?id=1674059
- https://bugzilla.redhat.com/show_bug.cgi?id=1678520
24 referansın hepsi
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7164
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7548
- https://errata.almalinux.org/8/ALSA-2019-0984.html
- https://errata.rockylinux.org/RLSA-2019:0984
- https://github.com/advisories/GHSA-887w-45rq-vxgf
- https://github.com/pypa/advisory-database/tree/main/vulns/sqlalchemy/PYSEC-2019-123.yaml
- https://github.com/sqlalchemy/sqlalchemy
- https://github.com/sqlalchemy/sqlalchemy/commit/30307c4616ad67c01ddae2e1e8e34fabf6028414
- https://github.com/sqlalchemy/sqlalchemy/issues/4481
- https://linux.oracle.com/cve/CVE-2019-7164.html
- https://linux.oracle.com/errata/ELSA-2019-0984.html
- https://lists.debian.org/debian-lts-announce/2019/03/msg00020.html
- https://lists.debian.org/debian-lts-announce/2021/11/msg00005.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-7164
- https://www.cve.org/CVERecord?id=CVE-2019-7164
- https://www.oracle.com/security-alerts/cpujan2021.html