Debian Security Advisory
DLA-2811-1 sqlalchemy -- LTS security update
- Date Reported:
- 06 Nov 2021
- Affected Packages:
- sqlalchemy
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 922669.
In Mitre's CVE dictionary: CVE-2019-7164, CVE-2019-7548. - More information:
-
Two SQL injection vulnerabilities were discovered in SQLAlchemy, a SQL toolkit and Object Relational Mapper for Python, when the order_by or group_by parameters can be controlled by an attacker.
Warning: The text coercion feature of SQLAlchemy is rarely used but the warning that has been previously emitted is now an ArgumentError or in case of the order_by() and group_by() parameters a CompileError.
For Debian 9 stretch, these problems have been fixed in version 1.0.15+ds1-1+deb9u1.
We recommend that you upgrade your sqlalchemy packages.
For the detailed security status of sqlalchemy please refer to its security tracker page at: https://security-tracker.debian.org/tracker/sqlalchemy
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS