CVE-2012-0805 SQLAlchemy vulnerable to SQL injection
HighCVSS 7.5
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi sqlalchemy(PyPI) | < 0.7.0b4 | 0.7.0b4 |
| pypi sqlalchemy(PyPI) | = 0.1.0 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.1.1 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.1.2 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.1.3 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.1.4 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.1.5 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.1.6 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.1.7 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.2.0 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.2.1 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.2.2 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.2.3 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.2.4 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.2.5 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.2.6 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.2.7 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.2.8 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.3.0 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.3.1 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.3.10 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.3.11 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.3.2 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.3.3 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.3.4 | No fix listed |
Show 69 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi sqlalchemy(PyPI) | = 0.3.5 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.3.6 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.3.7 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.3.8 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.3.9 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.0 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.0beta1 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.0beta2 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.0beta3 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.0beta4 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.0beta5 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.0beta6 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.1 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.2 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.2a | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.2b | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.3 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.4 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.5 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.6 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.7 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.4.8 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.5.0 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.5.0beta1 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.5.0beta2 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.5.0beta3 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.5.0rc1 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.5.0rc2 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.5.0rc3 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.5.0rc4 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.5.1 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.5.2 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.5.3 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.5.4 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.5.5 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.5.6 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.5.7 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.5.8 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.6.0 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.6.1 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.6.2 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.6.3 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.6.4 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.6.5 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.6.6 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.6.7 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.6.8 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.6.9 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.6beta1 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.6beta2 | No fix listed |
| pypi sqlalchemy(PyPI) | = 0.6beta3 | No fix listed |
| pypi sqlalchemy(PyPI) | < 0.7.0 | 0.7.0 |
| debian/sqlalchemy(Debian:12) | < 0.6.7-1 | 0.6.7-1 |
| debian/sqlalchemy(Debian:13) | < 0.6.7-1 | 0.6.7-1 |
| debian/sqlalchemy(Debian:14) | < 0.6.7-1 | 0.6.7-1 |
| sqlalchemy | <= 0.7.0 | No fix listed |
| sqlalchemy | = 0.6.0 | No fix listed |
| sqlalchemy | = 0.6.0-beta1 | No fix listed |
| sqlalchemy | = 0.6.0-beta2 | No fix listed |
| sqlalchemy | = 0.6.0-beta3 | No fix listed |
| sqlalchemy | = 0.6.1 | No fix listed |
| sqlalchemy | = 0.6.2 | No fix listed |
| sqlalchemy | = 0.6.3 | No fix listed |
| sqlalchemy | = 0.6.4 | No fix listed |
| sqlalchemy | = 0.6.5 | No fix listed |
| sqlalchemy | = 0.6.6 | No fix listed |
| sqlalchemy | = 0.6.7 | No fix listed |
| sqlalchemy | = 0.7.0-b1 | No fix listed |
| sqlalchemy | = 0.7.0-b2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bugs.launchpad.net
- sqlalchemy-select-sql-injection(73756) vdb-entry
- github.com
- github.com product
- web.archive.org
- web.archive.org
- web.archive.org
- RHSA-2012:0369 vendor-advisory
- DSA-2449 vendor-advisory
- www.sqlalchemy.org
- www.sqlalchemy.org exploit patch
- 48771 third-party-advisory vendor-advisory
- 48328 third-party-advisory vendor-advisory
- 48327 third-party-advisory vendor-advisory
- MDVSA-2012:059 vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2012-0805 vendor-advisory