01 Record

CVE-2019-7164

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 3.52% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 88.7% of scored records. A rank, not a probability.
NVD base score: 9.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2019-02-20 00:00Z7 YR AGO

Last updated

2024-08-04 20:38Z2 YR AGO

Reserved

2019-01-29

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Base

Data version

5.1

Document digest

9f57349e9c44eb1373ffb3a82b88be93454569e1ba46f74e2406e840eb9ced07

05 Affected products

VendorProductVersionsPlatforms

debiandebian_linuxNot specified—

opensusebackports_sleNot specified—

opensuseleapNot specified—

oraclecommunications_operations_monitorNot specified—

redhatceph_storageNot specified—

redhatenterprise_linuxNot specified—

redhatenterprise_linux_eusNot specified—

redhatenterprise_linux_server_ausNot specified—

redhatenterprise_linux_server_tusNot specified—

redhatopenstackNot specified—

redhatrhel_software_collectionsNot specified—

sqlalchemysqlalchemyNot specified—

06 References

lists.debian.org[debian-lts-announce] 20190318 [SECURITY] [DLA 1718-1] sqlalchemy security updatehttps://lists.debian.org/debian-lts-announce/2019/03/msg00020.htmlmailing-listx_refsource_MLIST
access.redhat.comRHSA-2019:0984https://access.redhat.com/errata/RHSA-2019:0984vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:0981https://access.redhat.com/errata/RHSA-2019:0981vendor-advisoryx_refsource_REDHAT
lists.opensuse.orgopenSUSE-SU-2019:2039http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.htmlvendor-advisoryx_refsource_SUSE
lists.opensuse.orgopenSUSE-SU-2019:2064http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.htmlvendor-advisoryx_refsource_SUSE
lists.opensuse.orgopenSUSE-SU-2019:2078http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.htmlvendor-advisoryx_refsource_SUSE
www.oracle.comhttps://www.oracle.com/security-alerts/cpujan2021.htmlx_refsource_MISC
github.comhttps://github.com/sqlalchemy/sqlalchemy/issues/4481x_refsource_MISC
lists.debian.org[debian-lts-announce] 20211106 [SECURITY] [DLA 2811-1] sqlalchemy security updatehttps://lists.debian.org/debian-lts-announce/2021/11/msg00005.htmlmailing-listx_refsource_MLIST

07 Fixed in

AlmaLinux 8

python-psycopg2-doc
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-Cython
Fixed in 0.28.1-7.module_el8.6.0+2781+fed64c13
python2-PyMySQL
Fixed in 0.8.0-10.module_el8.6.0+2781+fed64c13
python2-attrs
Fixed in 17.4.0-10.module_el8.6.0+2781+fed64c13
python2-chardet
Fixed in 3.0.4-10.module_el8.6.0+2781+fed64c13
python2-coverage
Fixed in 4.5.1-4.module_el8.6.0+2781+fed64c13
python2-docutils
Fixed in 0.14-12.module_el8.6.0+2781+fed64c13
python2-funcsigs
Fixed in 1.0.2-13.module_el8.6.0+2781+fed64c13
python2-idna
Fixed in 2.5-7.module_el8.6.0+2781+fed64c13
python2-ipaddress
Fixed in 1.0.18-6.module_el8.6.0+2781+fed64c13
python2-markupsafe
Fixed in 0.23-19.module_el8.6.0+2781+fed64c13
python2-mock
Fixed in 2.0.0-13.module_el8.6.0+2781+fed64c13
python2-pluggy
Fixed in 0.6.0-8.module_el8.6.0+2781+fed64c13
python2-psycopg2
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-psycopg2-debug
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-psycopg2-tests
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-py
Fixed in 1.5.3-6.module_el8.6.0+2781+fed64c13
python2-pysocks
Fixed in 1.6.8-6.module_el8.6.0+2781+fed64c13
python2-pytest
Fixed in 3.4.2-13.module_el8.6.0+2781+fed64c13
python2-pytest-mock
Fixed in 1.9.0-4.module_el8.6.0+2781+fed64c13
python2-pytz
Fixed in 2017.2-12.module_el8.6.0+2781+fed64c13
python2-pyyaml
Fixed in 3.12-16.module_el8.6.0+2781+fed64c13
python2-rpm-macros
Fixed in 3-38.module_el8.6.0+2781+fed64c13
python2-setuptools_scm
Fixed in 1.15.7-6.module_el8.6.0+2781+fed64c13
python3-docs
Fixed

A version is affected if any line below covers it.
- Affected before 3.6.7-2.module_el8.5.0+135+5ce32bc4
- Affected before 3.6.7-2.module_el8.5.0+2569+5c5719bc
python3-docutils
Fixed

A version is affected if any line below covers it.
- Affected before 0.14-12.module_el8.5.0+135+5ce32bc4
- Affected before 0.14-12.module_el8.5.0+2569+5c5719bc

CloudLinux 8

python-psycopg2-doc
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-Cython
Fixed in 0.28.1-7.module_el8.6.0+2781+fed64c13
python2-PyMySQL
Fixed in 0.8.0-10.module_el8.6.0+2781+fed64c13
python2-attrs
Fixed in 17.4.0-10.module_el8.6.0+2781+fed64c13
python2-chardet
Fixed in 3.0.4-10.module_el8.6.0+2781+fed64c13
python2-coverage
Fixed in 4.5.1-4.module_el8.6.0+2781+fed64c13
python2-docutils
Fixed in 0.14-12.module_el8.6.0+2781+fed64c13
python2-funcsigs
Fixed in 1.0.2-13.module_el8.6.0+2781+fed64c13
python2-idna
Fixed in 2.5-7.module_el8.6.0+2781+fed64c13
python2-ipaddress
Fixed in 1.0.18-6.module_el8.6.0+2781+fed64c13
python2-markupsafe
Fixed in 0.23-19.module_el8.6.0+2781+fed64c13
python2-mock
Fixed in 2.0.0-13.module_el8.6.0+2781+fed64c13
python2-pluggy
Fixed in 0.6.0-8.module_el8.6.0+2781+fed64c13
python2-psycopg2
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-psycopg2-debug
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-psycopg2-tests
Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
python2-py
Fixed in 1.5.3-6.module_el8.6.0+2781+fed64c13
python2-pysocks
Fixed in 1.6.8-6.module_el8.6.0+2781+fed64c13
python2-pytest
Fixed in 3.4.2-13.module_el8.6.0+2781+fed64c13
python2-pytest-mock
Fixed in 1.9.0-4.module_el8.6.0+2781+fed64c13
python2-pytz
Fixed in 2017.2-12.module_el8.6.0+2781+fed64c13
python2-pyyaml
Fixed in 3.12-16.module_el8.6.0+2781+fed64c13
python2-rpm-macros
Fixed in 3-38.module_el8.6.0+2781+fed64c13
python2-setuptools_scm
Fixed in 1.15.7-6.module_el8.6.0+2781+fed64c13
python3-docs
Fixed

A version is affected if any line below covers it.
- Affected before 3.6.7-2.module_el8.5.0+135+5ce32bc4
- Affected before 3.6.7-2.module_el8.5.0+2569+5c5719bc
python3-docutils
Fixed

A version is affected if any line below covers it.
- Affected before 0.14-12.module_el8.5.0+135+5ce32bc4
- Affected before 0.14-12.module_el8.5.0+2569+5c5719bc

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

Debian 12

sqlalchemy
Fixed in 1.2.18+ds1-2

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

sqlalchemy
Fixed in 1.2.18+ds1-2

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

sqlalchemy
Fixed in 1.2.18+ds1-2

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 16.04 LTS

sqlalchemy
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 18.04 LTS

sqlalchemy
No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.