CVE-2012-0805
SQLAlchemy vulnerable to SQL injection
CVE-2012-0805 is a high vulnerability (CVSS 7.5) in Sqlalchemy, published April 12, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.85%, the 86th percentile. Fixed in sqlalchemy 0.7.0b4.
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.
Exploit likelihood
What each source reports
NVD Score used
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.
- Record
CVE-2012-0805- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.
- Record
CVE-2012-0805- Updated
- 2026-11-02
EUVDEUVD-2012-0028 No score
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.
- Record
EUVD-2012-0028- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hfg2-wf6j-x53p
SQLAlchemy vulnerable to SQL injection
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.
- Record
GHSA-hfg2-wf6j-x53p- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-hfg2-wf6j-x53p
SQLAlchemy vulnerable to SQL injection
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.
- Record
GHSA-hfg2-wf6j-x53p- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV No score
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.
- Record
CVE-2012-0805- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-0805 No score
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.
- Record
DEBIAN-CVE-2012-0805- Updated
- 2026-11-02
OSVPYSEC-2012-9 No score
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.
- Record
PYSEC-2012-9- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sqlalchemyPyPI |
before 0.7.0b4 | 0.7.0b4 |
sqlalchemyDebian:12 |
before 0.6.7-1 | 0.6.7-1 |
sqlalchemyDebian:13 |
before 0.6.7-1 | 0.6.7-1 |
sqlalchemyDebian:14 |
before 0.6.7-1 | 0.6.7-1 |
sqlalchemyDebian:6.0 |
before 0.6.3-3+squeeze1, plus listed versions 0.6.3-3 |
0.6.3-3+squeeze1 |
sqlalchemyPyPI |
before 0.7.0b4, plus listed versions 0.1.00.1.10.1.20.1.30.1.4 Show 45 moreShow less0.1.50.1.60.1.70.2.00.2.10.2.20.2.30.2.40.2.50.2.60.2.70.2.80.3.00.3.10.3.100.3.110.3.20.3.30.3.40.3.50.3.60.3.70.3.80.3.90.4.00.4.0beta10.4.0beta20.4.0beta30.4.0beta40.4.0beta50.4.0beta60.4.10.4.20.4.2a0.4.2b0.4.30.4.40.4.50.4.60.4.70.4.80.5.00.5.0beta10.5.0beta20.5.0beta3 |
0.7.0b4 |
sqlalchemyPyPI |
before 0.7.0, plus listed versions 0.1.00.1.10.1.20.1.30.1.4 Show 45 moreShow less0.1.50.1.60.1.70.2.00.2.10.2.20.2.30.2.40.2.50.2.60.2.70.2.80.3.00.3.10.3.100.3.110.3.20.3.30.3.40.3.50.3.60.3.70.3.80.3.90.4.00.4.0beta10.4.0beta20.4.0beta30.4.0beta40.4.0beta50.4.0beta60.4.10.4.20.4.2a0.4.2b0.4.30.4.40.4.50.4.60.4.70.4.80.5.00.5.0beta10.5.0beta20.5.0beta3 |
0.7.0 |
python-sqlalchemyRed Hat:enterprise_linux:6::server |
before 0:0.5.5-3.el6_2 | 0:0.5.5-3.el6_2 |
python-sqlalchemyRed Hat:enterprise_linux:6::workstation |
before 0:0.5.5-3.el6_2 | 0:0.5.5-3.el6_2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
exchange.xforce.ibmcloud.com/vulnerabilities/73756
mandriva.com/security/advisories?name=MDVSA-2012:059
bugs.launchpad.net/keystone/+bug/918608
sqlalchemy.org/trac/changeset/852b6a1a87e7
debian.org/security/2012/dsa-2449
Show 19 moreShow less
secunia.com/advisories/48771
rhn.redhat.com/errata/RHSA-2012-0369.html
nvd.nist.gov/vuln/detail/CVE-2012-0805
github.com/sqlalchemy/sqlalchemy/commit/51fea2e159ca93daa0bc8066a5c35d8436d99418
web.archive.org/web/20140721183117/http://secunia.com/advisories/48771
security-tracker.debian.org/tracker/CVE-2012-0805
access.redhat.com/errata/RHSA-2012:0369
bugzilla.redhat.com/show_bug.cgi?id=783305
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0369.json
cve.org/CVERecord?id=CVE-2012-0805
Left out here: 50 versions. The JSON record has them.