CVE-2012-0805
NONE EPSS 85.1%
Published Jun 5, 201214y ago · Modified Jun 16, 20262w ago
Published Jun 5, 2012 14y ago
Last Modified Jun 16, 2026 2w ago
Description
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.
Threat Intelligence
EPSS Exploit Probability
85.1% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available
Weaknesses 1
CWE-89 SQL Injection Injection
Affected Products 14
| Vendor | Product | Version | Range |
|---|---|---|---|
| sqlalchemy | sqlalchemy | * | ≤0.7.0 |
| sqlalchemy | sqlalchemy | 0.6.0 | any |
| sqlalchemy | sqlalchemy | 0.6.0 | any |
| sqlalchemy | sqlalchemy | 0.6.0 | any |
| sqlalchemy | sqlalchemy | 0.6.0 | any |
| sqlalchemy | sqlalchemy | 0.6.1 | any |
| sqlalchemy | sqlalchemy | 0.6.2 | any |
| sqlalchemy | sqlalchemy | 0.6.3 | any |
| sqlalchemy | sqlalchemy | 0.6.4 | any |
| sqlalchemy | sqlalchemy | 0.6.5 | any |
| sqlalchemy | sqlalchemy | 0.6.6 | any |
| sqlalchemy | sqlalchemy | 0.6.7 | any |
| sqlalchemy | sqlalchemy | 0.7.0 | any |
| sqlalchemy | sqlalchemy | 0.7.0 | any |
References 10
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2012-0369.html
- secunia.com http://secunia.com/advisories/48327
- secunia.com http://secunia.com/advisories/48328
- secunia.com http://secunia.com/advisories/48771
- debian.org http://www.debian.org/security/2012/dsa-2449
- mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2012:059
- sqlalchemy.org http://www.sqlalchemy.org/changelog/CHANGES_0_7_0
- sqlalchemy.org http://www.sqlalchemy.org/trac/changeset/852b6a1a87e7/
- bugs.launchpad.net https://bugs.launchpad.net/keystone/+bug/918608
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/73756
Remediation
- sqlalchemy.org http://www.sqlalchemy.org/trac/changeset/852b6a1a87e7/