Executive Summary
| Summary | |
|---|---|
| Title | python-sqlalchemy security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2012:0369 | First vendor Publication | 2012-03-07 |
| Vendor | RedHat | Last vendor Modification | 2012-03-07 |
| Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: An updated python-sqlalchemy package that fixes one security issue is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server (v. 6) - noarch Red Hat Enterprise Linux Workstation (v. 6) - noarch 3. Description: SQLAlchemy is an Object Relational Mapper (ORM) that provides a flexible, high-level interface to SQL databases. It was discovered that SQLAlchemy did not sanitize values for the limit and offset keywords for SQL select statements. If an application using SQLAlchemy accepted values for these keywords, and did not filter or sanitize them before passing them to SQLAlchemy, it could allow an attacker to perform an SQL injection attack against the application. (CVE-2012-0805) All users of python-sqlalchemy are advised to upgrade to this updated package, which contains a patch to correct this issue. All running applications using SQLAlchemy must be restarted for this update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 783305 - CVE-2012-0805 python-sqlalchemy: SQL injection flaw due to not checking LIMIT input for correct type |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2012-0369.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-89 | Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection') (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:18475 | |||
| Oval ID: | oval:org.mitre.oval:def:18475 | ||
| Title: | DSA-2449-1 sqlalchemy - missing input sanitisation | ||
| Description: | It was discovered that SQLAlchemy, an SQL toolkit and object relational mapper for Python, is not sanitising input passed to the limit/offset keywords to select() as well as the value passed to select.limit()/offset(). This allows an attacker to perform SQL injection attacks against applications using SQLAlchemy that do not implement their own filtering. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2449-1 CVE-2012-0805 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | sqlalchemy |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:20474 | |||
| Oval ID: | oval:org.mitre.oval:def:20474 | ||
| Title: | RHSA-2012:0369: python-sqlalchemy security update (Moderate) | ||
| Description: | Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2012:0369-01 CESA-2012:0369 CVE-2012-0805 | Version: | 4 |
| Platform(s): | Red Hat Enterprise Linux 6 CentOS Linux 6 | Product(s): | python-sqlalchemy |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:23515 | |||
| Oval ID: | oval:org.mitre.oval:def:23515 | ||
| Title: | ELSA-2012:0369: python-sqlalchemy security update (Moderate) | ||
| Description: | Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2012:0369-01 CVE-2012-0805 | Version: | 6 |
| Platform(s): | Oracle Linux 6 | Product(s): | python-sqlalchemy |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:27246 | |||
| Oval ID: | oval:org.mitre.oval:def:27246 | ||
| Title: | DEPRECATED: ELSA-2012-0369 -- python-sqlalchemy security update (moderate) | ||
| Description: | [0.5.5-3] - sanitize inputs to limit() and offset() Resolves: CVE-2012-0805 | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2012-0369 CVE-2012-0805 | Version: | 4 |
| Platform(s): | Oracle Linux 6 | Product(s): | python-sqlalchemy |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-10-03 | Name : Gentoo Security Advisory GLSA 201209-16 (sqlalchemy) File : nvt/glsa_201209_16.nasl |
| 2012-08-30 | Name : Fedora Update for python-sqlalchemy0.5 FEDORA-2012-3373 File : nvt/gb_fedora_2012_3373_python-sqlalchemy0.5_fc17.nasl |
| 2012-08-03 | Name : Mandriva Update for python-sqlalchemy MDVSA-2012:059 (python-sqlalchemy) File : nvt/gb_mandriva_MDVSA_2012_059.nasl |
| 2012-07-30 | Name : CentOS Update for python-sqlalchemy CESA-2012:0369 centos6 File : nvt/gb_CESA-2012_0369_python-sqlalchemy_centos6.nasl |
| 2012-07-09 | Name : RedHat Update for python-sqlalchemy RHSA-2012:0369-01 File : nvt/gb_RHSA-2012_0369-01_python-sqlalchemy.nasl |
| 2012-04-30 | Name : Debian Security Advisory DSA 2449-1 (sqlalchemy) File : nvt/deb_2449_1.nasl |
| 2012-04-02 | Name : Fedora Update for python-sqlalchemy0.5 FEDORA-2012-3412 File : nvt/gb_fedora_2012_3412_python-sqlalchemy0.5_fc16.nasl |
| 2012-04-02 | Name : Fedora Update for python-sqlalchemy0.5 FEDORA-2012-3414 File : nvt/gb_fedora_2012_3414_python-sqlalchemy0.5_fc15.nasl |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2012-0369.nasl - Type : ACT_GATHER_INFO |
| 2012-09-27 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201209-16.nasl - Type : ACT_GATHER_INFO |
| 2012-09-06 | Name : The remote Mandriva Linux host is missing a security update. File : mandriva_MDVSA-2012-059.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20120307_python_sqlalchemy_on_SL6.nasl - Type : ACT_GATHER_INFO |
| 2012-04-13 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2449.nasl - Type : ACT_GATHER_INFO |
| 2012-04-12 | Name : The remote Fedora host is missing a security update. File : fedora_2012-3373.nasl - Type : ACT_GATHER_INFO |
| 2012-04-02 | Name : The remote Fedora host is missing a security update. File : fedora_2012-3412.nasl - Type : ACT_GATHER_INFO |
| 2012-04-02 | Name : The remote Fedora host is missing a security update. File : fedora_2012-3414.nasl - Type : ACT_GATHER_INFO |
| 2012-03-08 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2012-0369.nasl - Type : ACT_GATHER_INFO |
| 2012-03-08 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2012-0369.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:55:46 |
|
