SQL injection in SQLAlchemy - CVE-2012-0805

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Affected software

How to mitigate CVE-2012-0805

External References

• http://rhn.redhat.com/errata/RHSA-2012-0369.html
• http://secunia.com/advisories/48327
• http://secunia.com/advisories/48328
• http://secunia.com/advisories/48771
• http://www.debian.org/security/2012/dsa-2449
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:059
• http://www.sqlalchemy.org/changelog/CHANGES_0_7_0
• http://www.sqlalchemy.org/trac/changeset/852b6a1a87e7/
• https://bugs.launchpad.net/keystone/+bug/918608
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73756

Related Security Bulletins

• SQL injection in SQLAlchemy
• Gentoo update for SQLAlchemy
• Fedora EPEL 5 update for python-sqlalchemy0.5
• Fedora EPEL 5 update for python-sqlalchemy