VDB
PYSEC-2019-124
PYSEC-2019-124
PUBLISHED
CVSS 9.300000190734863 CRITICAL
Record from OSV · Published February 6, 2019
sqlalchemy is fixed in 1.2.18 (PyPI)
SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| sqlalchemy | PyPI | 1.2.18 |
Risk scores
CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | sqlalchemy | 1.1.0b3, 0, 0.1.0 |
Timeline
- Feb 6, 2019 CVE Published
- Nov 8, 2023 CVE Updated
- May 1, 2026 Distribution Patch (2 in total, the first dated here)
- May 1, 2026 Security Advisory (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln PYSEC-2019-124
vulnetix vdb fixes PYSEC-2019-124Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/PYSEC-2019-124/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/no-security/sqlalchemy_test url
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html url
- https://www.oracle.com/security-alerts/cpujan2021.html url
- https://github.com/advisories/GHSA-38fc-9xqv-7f7q advisory
- https://github.com/sqlalchemy/sqlalchemy/issues/4481#issuecomment-461204518 discussion
- https://access.redhat.com/errata/RHSA-2019:0984 advisory
- https://lists.debian.org/debian-lts-announce/2019/03/msg00020.html url
- https://access.redhat.com/errata/RHSA-2019:0981 advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html url
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html url