CVE-2019-7548: SQL Injection in SQLAlchemy
Summary
CVE-2019-7548: SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled. Affects sqlalchemy versions < 1.2.18. Fixed in 1.2.18. How to fix ↓
Also tracked for
- sqlalchemy · Debian:11
The same CVE-2019-7548 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SQLAlchemy is a popular Python SQL toolkit and Object-Relational Mapping (ORM) library. It provides a set of high-level API for interacting with databases, allowing developers to write SQL queries in a more Pythonic way. SQLAlchemy is widely used in various Python applications and frameworks.
Vulnerability Detail
The vulnerability identified as CVE-2019-7548 is a SQL Injection vulnerability in SQLAlchemy version 1.2.17. This vulnerability arises when the 'group_by' parameter can be controlled by an attacker. An attacker can exploit this vulnerability to inject malicious SQL code, potentially leading to unauthorized access, data manipulation, or data leakage. The vulnerability was fixed in version 1.2.18 of SQLAlchemy.
How To Fix
Minimum fixed version
1.2.18
This is the first release that contains the fix.
pip install --upgrade "sqlalchemy==1.2.18"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is recommended to sanitize and validate user input before using it in SQL queries to prevent SQL Injection attacks. Developers should use parameterized queries or prepared statements to ensure that user input is properly escaped and treated as data rather than executable code.
Conclusion
In conclusion, the SQL Injection vulnerability (CVE-2019-7548) in SQLAlchemy version 1.2.17 can be exploited by an attacker to execute arbitrary SQL code. It is crucial to upgrade to version 1.2.18 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for sqlalchemy →
FAQ
SQLAlchemy is a Python SQL toolkit and ORM library used for interacting with databases.
SQL Injection is a type of vulnerability where an attacker can manipulate SQL queries to execute arbitrary SQL code, potentially leading to unauthorized access or data manipulation.
This vulnerability in SQLAlchemy can allow an attacker to inject malicious SQL code, potentially leading to unauthorized access, data manipulation, or data leakage in applications that use the affected version.
Yes, the vulnerability has been fixed in SQLAlchemy version 1.2.18.
To protect your application, it is recommended to upgrade SQLAlchemy to version 1.2.18 or later and follow secure coding practices to prevent SQL Injection vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for sqlalchemy.
