CVE-2019-7164 SQLAlchemy vulnerable to SQL Injection via order_by parameter
SQL injection in SQLAlchemy allows attackers to manipulate database queries via the order_by parameter, risking data exposure or modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-7164?
CVE-2019-7164 is a critical SQL injection vulnerability in Debian Debian Linux, published on 20 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
Weakness: CWE-89
Which versions are affected by CVE-2019-7164?
3 open source packages ship an affected version, including sqlalchemy and SQLAlchemy. It affects 9 products.
| Package | Affected | Fixed in |
|---|---|---|
sqlalchemy PyPI | All versions | 1.3.0b3 |
sqlalchemy PyPI | All versions | 1.3.0b3 |
SQLAlchemy PyPI | All versions | 1.3.0b3 |
Linux distribution packages (2)
python-SQLAlchemy openSUSE:Tumbleweed | All versions | 1.4.22-1.2 |
python-SQLAlchemy openSUSE:Tumbleweed | All versions | 1.4.46-2.1 |
Products include Debian Debian Linux, Opensuse Backports Sle, Opensuse Leap, Oracle Communications Operations Monitor, Redhat Enterprise Linux, Redhat Enterprise Linux Eus and 3 more.
How do I fix CVE-2019-7164?
Upgrade sqlalchemy to 1.3.0b3 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2019-7164 being exploited?
There is no known exploitation of CVE-2019-7164 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2019-7164, GHSA-887w-45rq-vxgf, OESA-2021-1039, OESA-2021-1071, PYSEC-2019-123, UBUNTU-CVE-2019-7164 and 2 more.