Moderate: python36:3.6 security update
Summary
ALSA-2019:0984: Moderate: python36:3.6 security update. Affects python3-docs across 2 version ranges.
< 3.6.7-2.module_el8.5.0+135+5ce32bc4
< 3.6.7-2.module_el8.5.0+2569+5c5719bc
Fixed in 3.6.7-2.module_el8.5.0+135+5ce32bc4 or 3.6.7-2.module_el8.5.0+2569+5c5719bc, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. SQLAlchemy is an Object Relational Mapper (ORM) that provides a flexible, high-level interface to SQL databases.
Vulnerability Detail
The vulnerability in python-sqlalchemy allows for SQL Injection when the order_by parameter or the group_by parameter can be controlled. This could potentially lead to unauthorized access, data leakage, or data manipulation in SQL databases.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update python3-docs-
< 3.6.7-2.module_el8.5.0+135+5ce32bc43.6.7-2.module_el8.5.0+135+5ce32bc4 -
< 3.6.7-2.module_el8.5.0+2569+5c5719bc3.6.7-2.module_el8.5.0+2569+5c5719bc
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
In conclusion, the python-sqlalchemy package is vulnerable to SQL Injection when the order_by or group_by parameter can be controlled. It is recommended to update to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python3-docs →
FAQ
Python is an interpreted, interactive, object-oriented programming language.
SQLAlchemy is an Object Relational Mapper (ORM) that provides a flexible, high-level interface to SQL databases.
SQL Injection is a code injection technique that attackers use to exploit vulnerabilities in a website's database layer.
This vulnerability could allow attackers to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
To fix this vulnerability, update the python-sqlalchemy package to version 3.6.7-2.module_el8.5.0+2569+5c5719bc or later.
Related vulnerabilities
Recent vulnerabilities recorded for python3-docs.
