{"id":"CVE-2012-0805","aliases":["DEBIAN-CVE-2012-0805","DSA-2449-1","EUVD-2012-0028","GHSA-hfg2-wf6j-x53p","PYSEC-2012-9","RHSA-2012:0369"],"status":"published","title":"SQLAlchemy vulnerable to SQL injection","description":"Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0283,"percentile":0.86709,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2012-04-12T00:00:00Z","modified":"2026-10-23T17:47:37Z","fixes":[{"ecosystem":"PyPI","package":"sqlalchemy","fixed_in":["0.7.0b4","0.7.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"sqlalchemy","fixed_in":["0.6.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sqlalchemy","fixed_in":["0.6.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sqlalchemy","fixed_in":["0.6.7-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"sqlalchemy","fixed_in":["0.6.3-3+squeeze1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"python-sqlalchemy","fixed_in":["0:0.5.5-3.el6_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"python-sqlalchemy","fixed_in":["0:0.5.5-3.el6_2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"sqlalchemy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0b4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sqlalchemy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sqlalchemy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sqlalchemy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.7-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"sqlalchemy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-3+squeeze1"}]}],"versions":["0.6.3-3"]},{"source":"osv","ecosystem":"PyPI","package":"sqlalchemy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0b4"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.2.8","0.3.0","0.3.1","0.3.10","0.3.11","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","0.4.0","0.4.0beta1","0.4.0beta2","0.4.0beta3","0.4.0beta4","0.4.0beta5","0.4.0beta6","0.4.1","0.4.2","0.4.2a","0.4.2b","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.5.0","0.5.0beta1","0.5.0beta2","0.5.0beta3","0.5.0rc1","0.5.0rc2","0.5.0rc3","0.5.0rc4","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.6beta1","0.6beta2","0.6beta3"]},{"source":"osv","ecosystem":"PyPI","package":"sqlalchemy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.2.8","0.3.0","0.3.1","0.3.10","0.3.11","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","0.4.0","0.4.0beta1","0.4.0beta2","0.4.0beta3","0.4.0beta4","0.4.0beta5","0.4.0beta6","0.4.1","0.4.2","0.4.2a","0.4.2b","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.5.0","0.5.0beta1","0.5.0beta2","0.5.0beta3","0.5.0rc1","0.5.0rc2","0.5.0rc3","0.5.0rc4","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.6.0","0.6.1","0.6.2","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.6beta1","0.6beta2","0.6beta3"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"python-sqlalchemy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.5-3.el6_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"python-sqlalchemy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.5-3.el6_2"}]}]}],"products":[{"vendor":"sqlalchemy","product":"sqlalchemy"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/73756","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2012:059","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"https://bugs.launchpad.net/keystone/+bug/918608","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.sqlalchemy.org/trac/changeset/852b6a1a87e7/","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix","web"]},{"url":"http://www.debian.org/security/2012/dsa-2449","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://www.sqlalchemy.org/changelog/CHANGES_0_7_0","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/48771","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/48328","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/48327","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-0369.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-0805","tags":["advisory"]},{"url":"https://github.com/sqlalchemy/sqlalchemy/commit/51fea2e159ca93daa0bc8066a5c35d8436d99418","tags":["web"]},{"url":"https://web.archive.org/web/20140721183117/http://secunia.com/advisories/48771","tags":["web"]},{"url":"https://web.archive.org/web/20140802043526/http://secunia.com/advisories/48328","tags":["web"]},{"url":"https://web.archive.org/web/20140802044957/http://secunia.com/advisories/48327","tags":["web"]},{"url":"http://www.sqlalchemy.org/trac/changeset/852b6a1a87e7","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/sqlalchemy/PYSEC-2012-9.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hfg2-wf6j-x53p","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2012-0805","tags":["advisory"]},{"url":"https://github.com/sqlalchemy/sqlalchemy","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2012:0369","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=783305","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0369.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-0805","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-0805","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2012-0805","description":"Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.","status":"published","published":"2012-06-05T22:00:00Z","modified":"2024-08-06T18:38:14.544Z","updated_at":"2026-11-02T14:34:52.981189Z"}],"euvd":[{"id":"EUVD-2012-0028","description":"Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.","status":"published","published":"2012-06-05T22:00:00Z","modified":"2024-08-06T18:38:14Z","updated_at":"2026-11-03T01:56:20.258269Z"}],"ghsa":[{"id":"GHSA-hfg2-wf6j-x53p","title":"SQLAlchemy vulnerable to SQL injection","description":"Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.","status":"published","published":"2022-05-14T03:49:27Z","modified":"2024-10-28T14:40:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:38:13.90937Z"}],"nvd":[{"id":"CVE-2012-0805","description":"Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.","status":"published","published":"2012-06-05T22:55:08.077Z","modified":"2026-06-16T23:38:17.657Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:02:14.336529Z"}],"osv":[{"id":"GHSA-hfg2-wf6j-x53p","title":"SQLAlchemy vulnerable to SQL injection","description":"Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.","status":"published","published":"2022-05-14T03:49:27Z","modified":"2024-10-28T15:04:29.386399Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:48.920784Z"},{"id":"CVE-2012-0805","description":"Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.","status":"published","published":"2012-06-05T22:55:08Z","modified":"2026-04-10T03:42:11.282844Z","updated_at":"2026-11-02T15:43:58.537032Z"},{"id":"DEBIAN-CVE-2012-0805","description":"Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.","status":"published","published":"2012-06-05T22:55:08.077Z","modified":"2026-10-23T17:47:37.843466642Z","updated_at":"2026-11-02T15:45:24.92418Z"},{"id":"DSA-2449-1","title":"sqlalchemy - missing input sanitization","status":"published","published":"2012-04-12T00:00:00Z","modified":"2026-03-09T01:18:21.955684Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"PYSEC-2012-9","description":"Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.","status":"published","published":"2012-06-05T22:55:00Z","modified":"2026-06-10T17:02:41.761007706Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"RHSA-2012:0369","title":"Red Hat Security Advisory: python-sqlalchemy security update","status":"published","published":"2024-09-15T19:41:00Z","modified":"2025-11-22T10:36:20Z","updated_at":"2026-11-02T15:53:01.495018Z"}]}}