CVE-2019-7164

SQLAlchemy before 1.3.0b3 allows SQL Injection via the order_by parameter. The fix (commit 30307c4) was applied only to the main branch and was never backported to the 1.2.x release line; all 1.2.x versions remain vulnerable.

SQLAlchemy is an Object Relational Mapper (ORM) that provides a flexible, high-level interface to SQL databases. It contains a powerful mapping layer that users can choose to work as automatically or as manually, determining relationships based on foreign keys or to bridge the gap between database and domain by letting you define the join conditions explicitly.\r\n\r\n Security Fix(es):\r\n\r\n SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.(CVE-2019-7164)\r\n\r\n

SQLAlchemy is an Object Relational Mapper (ORM) that provides a flexible, high-level interface to SQL databases. It contains a powerful mapping layer that users can choose to work as automatically or as manually, determining relationships based on foreign keys or to bridge the gap between database and domain by letting you define the join conditions explicitly.

Security Fix(es):

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.(CVE-2019-7164)

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing.

SQLAlchemy is an Object Relational Mapper (ORM) that provides a flexible, high-level interface to SQL databases.

Security Fix(es):

• python: Information Disclosure due to urlsplit improper NFKC normalization (CVE-2019-9636)

• python-sqlalchemy: SQL Injection when the order_by parameter can be controlled (CVE-2019-7164)

• python-sqlalchemy: SQL Injection when the group_by parameter can be controlled (CVE-2019-7548)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

SQLAlchemy is an Object Relational Mapper (ORM) that provides a flexible, high-level interface to SQL databases.

Security Fix(es):

• python-sqlalchemy: SQL Injection when the order_by parameter can be controlled (CVE-2019-7164)

• python-sqlalchemy: SQL Injection when the group_by parameter can be controlled (CVE-2019-7548)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.

Python is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, high-level dynamic data types, and dynamic typing.

SQLAlchemy is an Object Relational Mapper (ORM) that provides a flexible, high-level interface to SQL databases.

Security Fix(es):

• python: Information Disclosure due to urlsplit improper NFKC normalization (CVE-2019-9636)

• python-sqlalchemy: SQL Injection when the order_by parameter can be controlled (CVE-2019-7164)

• python-sqlalchemy: SQL Injection when the group_by parameter can be controlled (CVE-2019-7548)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

SQLAlchemy is an Object Relational Mapper (ORM) that provides a flexible, high-level interface to SQL databases.

Security Fix(es):

• python-sqlalchemy: SQL Injection when the order_by parameter can be controlled (CVE-2019-7164)

• python-sqlalchemy: SQL Injection when the group_by parameter can be controlled (CVE-2019-7548)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Updated python-sqlalchemy packages fix security vulnerabilities:

SQL Injection via the order_by parameter (CVE-2019-7164).

SQL Injection via the group_by parameter (CVE-2019-7548).

This update for python-SQLAlchemy fixes the following issues:

Security issues fixed:

• CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593).
• CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593).

This update was imported from the SUSE:SLE-15:Update update project.

This update for python-SQLAlchemy fixes the following issues:

Security issues fixed:

• CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593).
• CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for python-SQLAlchemy fixes the following issues:

Security issues fixed:

• CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593).
• CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593).

This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.0:Update update project.

These are all security issues fixed in the python-SQLAlchemy-doc-1.4.22-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python-SQLAlchemy1-doc-1.4.46-2.1 package on the GA media of openSUSE Tumbleweed.

SQLAlchemy before 1.3.0b3 allows SQL Injection via the order_by parameter. The fix (commit 30307c4) was applied only to the main branch and was never backported to the 1.2.x release line; all 1.2.x versions remain vulnerable.

This update for python-SQLAlchemy fixes the following issues:

Security issues fixed:

• CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593).
• CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593).

This update for python-SQLAlchemy fixes the following issues:

Security issues fixed:

• CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593).
• CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593).

This update for python-SQLAlchemy fixes the following issues:

Security issues fixed:

• CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593).
• CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593).

This update for python-SQLAlchemy fixes the following issues:

Security issues fixed:

• CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593).
• CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593).

This update for ardana-ansible, ardana-barbican, ardana-cinder, ardana-cluster, ardana-cobbler, ardana-db, ardana-designate, ardana-extensions-nsx, ardana-glance, ardana-heat, ardana-horizon, ardana-input-model, ardana-installer-ui, ardana-ironic, ardana-keystone, ardana-logging, ardana-magnum, ardana-monasca, ardana-mq, ardana-neutron, ardana-nova, ardana-octavia, ardana-opsconsole, ardana-opsconsole-ui, ardana-osconfig, ardana-service, ardana-ses, ardana-swift, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, java-monasca-common, java-monasca-common-kit, openstack-ceilometer, openstack-cinder, openstack-designate, openstack-heat, openstack-horizon-plugin-neutron-fwaas-ui, openstack-horizon-plugin-neutron-lbaas-ui, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-ironic, openstack-ironic-python-agent, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-notification, openstack-monasca-persister, openstack-monasca-persister-java, openstack-monasca-persister-java-kit, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, openstack-octavia, openstack-tempest, python-ardana-configurationprocessor, python-cinder-tempest-plugin, python-ironicclient, python-keystonemiddleware, python-monasca-tempest-plugin, python-openstackclient, python-openstacksdk, python-proliantutils, python-python-engineio, python-swiftlm, python-vmware-nsx, python-vmware-nsxlib, yast2-crowbar fixes the following issues:

• Update to version 9.0+git.1566374020.301191f:

  • Use raw image format when using SES backend on Nova (SOC-9285)

• Update to version 9.0+git.1563375514.31fa9a7:

  • Ensure ardana-update-pkgs works for dist-upgrade (SOC-9857)

• Update to version 9.0+git.1563192450.30e8f16:

  • Ensure Cloud8/SLE-12-SP3 repps still served (SOC-9840)

• Update to version 9.0+git.1566251498.be02ca4:

  • adds ipv6 format to http/https urls (SOC-10063)

• Update to version 9.0+git.1565678764.c3a9b9f:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1562898832.1731f25:

  • FIX broken symlink for policy.yaml.j2. (SOC-0000)

• Update to version 9.0+git.1559333871.40508f7:

  • Allow system to bind to non local ipv6 addresses (SOC-9330)

• Update to version 9.0+git.1566336494.93967dd:

  • Using python netaddr for ipv6 address comparison (SOC-9940)

• Update to version 9.0+git.1564409964.b7e4fc3:

  • Don't use 'latest' with 'zypper' (SOC-9997)

• Update to version 9.0+git.1562182567.aef23e0:

  • Format curl commands for ipv6 (SOC-9369)

• Update to version 9.0+git.1565680593.df7a432:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1566213657.69862ab:

  • Add missing service plugin for l2gw (SOC-5837)

• Update to version 9.0+git.1563904379.31ff1e9:

  • Add the NSX-T L2-Gateway Service definition (SOC-5837)

• Switch to new Gerrit Server

• Update to version 9.0+git.1566375806.f0b2333:

  • Configure glance image_direct_url/multiple_locations (SOC-9285)

• Update to version 9.0+git.1565720518.c7fdca2:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1564491141.602fdf9:

  • Default glance_default_store to rbd if SES enabled (SOC-8749)

• Update to version 9.0+git.1565721273.f44b8d7:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1565891518.2a545a1:

  • adds ipv6 format to urls (SOC-10063)

• Update to version 9.0+git.1565655129.ab3a58c:

  • Removed None condition from rule (SOC-10003)

• Update to version 9.0+git.1564609155.033a963:

  • Updated heat_policy.json permission to be 664 (SOC-9872)

• Update to version 9.0+git.1562848565.91e75b2:

  • Include memcached in the minimal ardana-ci model (SOC-9800)

• Update to version 9.0+git.1566255088.3443670:

  • Add server state column (SOC-9957)

• Update to version 9.0+git.1565218199.868c5d1:

  • Add ipv6 support (SOC-9677) (#357)

• Update to version 9.0+git.1563912815.7090c20:

  • Only show ses config upload option when ses is not configured (SOC-8555)…

This update for python-SQLAlchemy fixes the following issues:

Security issues fixed:

• CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593).
• CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593).

This update for python-SQLAlchemy fixes the following issues:

Security issues fixed:

• CVE-2019-7164: Fixed SQL Injection via the order_by parameter (bsc#1124593).
• CVE-2019-7548: Fixed SQL Injection via the group_by parameter (bsc#1124593).