Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | sqlalchemy security update |
| Informations | |||
|---|---|---|---|
| Name | DSA-2449 | First vendor Publication | 2012-04-12 |
| Vendor | Debian | Last vendor Modification | 2012-04-12 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| It was discovered that sqlalchemy, an SQL toolkit and object relational mapper for python, is not sanitizing input passed to the limit/offset keywords to select() as well as the value passed to select.limit()/offset(). This allows an attacker to perform SQL injection attacks against applications using sqlalchemy that do not implement their own filtering. For the stable distribution (squeeze), this problem has been fixed in version 0.6.3-3+squeeze1. For the testing distribution (wheezy), this problem has been fixed in version 0.6.7-1. For the unstable distribution (sid), this problem has been fixed in version 0.6.7-1. We recommend that you upgrade your sqlalchemy packages. |
Original Source
| Url : http://www.debian.org/security/2012/dsa-2449 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-89 | Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:18475 | |||
| Oval ID: | oval:org.mitre.oval:def:18475 | ||
| Title: | DSA-2449-1 sqlalchemy - missing input sanitisation | ||
| Description: | It was discovered that SQLAlchemy, an SQL toolkit and object relational mapper for Python, is not sanitising input passed to the limit/offset keywords to select() as well as the value passed to select.limit()/offset(). This allows an attacker to perform SQL injection attacks against applications using SQLAlchemy that do not implement their own filtering. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2449-1 CVE-2012-0805 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | sqlalchemy |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:20474 | |||
| Oval ID: | oval:org.mitre.oval:def:20474 | ||
| Title: | RHSA-2012:0369: python-sqlalchemy security update (Moderate) | ||
| Description: | Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2012:0369-01 CESA-2012:0369 CVE-2012-0805 | Version: | 4 |
| Platform(s): | Red Hat Enterprise Linux 6 CentOS Linux 6 | Product(s): | python-sqlalchemy |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:23515 | |||
| Oval ID: | oval:org.mitre.oval:def:23515 | ||
| Title: | ELSA-2012:0369: python-sqlalchemy security update (Moderate) | ||
| Description: | Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2012:0369-01 CVE-2012-0805 | Version: | 6 |
| Platform(s): | Oracle Linux 6 | Product(s): | python-sqlalchemy |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:27246 | |||
| Oval ID: | oval:org.mitre.oval:def:27246 | ||
| Title: | DEPRECATED: ELSA-2012-0369 -- python-sqlalchemy security update (moderate) | ||
| Description: | [0.5.5-3] - sanitize inputs to limit() and offset() Resolves: CVE-2012-0805 | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2012-0369 CVE-2012-0805 | Version: | 4 |
| Platform(s): | Oracle Linux 6 | Product(s): | python-sqlalchemy |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-10-03 | Name : Gentoo Security Advisory GLSA 201209-16 (sqlalchemy) File : nvt/glsa_201209_16.nasl |
| 2012-08-30 | Name : Fedora Update for python-sqlalchemy0.5 FEDORA-2012-3373 File : nvt/gb_fedora_2012_3373_python-sqlalchemy0.5_fc17.nasl |
| 2012-08-03 | Name : Mandriva Update for python-sqlalchemy MDVSA-2012:059 (python-sqlalchemy) File : nvt/gb_mandriva_MDVSA_2012_059.nasl |
| 2012-07-30 | Name : CentOS Update for python-sqlalchemy CESA-2012:0369 centos6 File : nvt/gb_CESA-2012_0369_python-sqlalchemy_centos6.nasl |
| 2012-07-09 | Name : RedHat Update for python-sqlalchemy RHSA-2012:0369-01 File : nvt/gb_RHSA-2012_0369-01_python-sqlalchemy.nasl |
| 2012-04-30 | Name : Debian Security Advisory DSA 2449-1 (sqlalchemy) File : nvt/deb_2449_1.nasl |
| 2012-04-02 | Name : Fedora Update for python-sqlalchemy0.5 FEDORA-2012-3412 File : nvt/gb_fedora_2012_3412_python-sqlalchemy0.5_fc16.nasl |
| 2012-04-02 | Name : Fedora Update for python-sqlalchemy0.5 FEDORA-2012-3414 File : nvt/gb_fedora_2012_3414_python-sqlalchemy0.5_fc15.nasl |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2012-0369.nasl - Type : ACT_GATHER_INFO |
| 2012-09-27 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201209-16.nasl - Type : ACT_GATHER_INFO |
| 2012-09-06 | Name : The remote Mandriva Linux host is missing a security update. File : mandriva_MDVSA-2012-059.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20120307_python_sqlalchemy_on_SL6.nasl - Type : ACT_GATHER_INFO |
| 2012-04-13 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2449.nasl - Type : ACT_GATHER_INFO |
| 2012-04-12 | Name : The remote Fedora host is missing a security update. File : fedora_2012-3373.nasl - Type : ACT_GATHER_INFO |
| 2012-04-02 | Name : The remote Fedora host is missing a security update. File : fedora_2012-3412.nasl - Type : ACT_GATHER_INFO |
| 2012-04-02 | Name : The remote Fedora host is missing a security update. File : fedora_2012-3414.nasl - Type : ACT_GATHER_INFO |
| 2012-03-08 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2012-0369.nasl - Type : ACT_GATHER_INFO |
| 2012-03-08 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2012-0369.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:30:59 |
|
