Homepage

SQLAlchemy@0.4.8 vulnerabilities

Database Abstraction Library

  • latest version

    2.0.43

  • latest non vulnerable version

    2.0.43

  • first published

    19 years ago

  • latest version published

    1 months ago

  • licenses detected

  • View SQLAlchemy package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the SQLAlchemy package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    SQL Injection

    SQLAlchemy is a python SQL Toolkit and Object Relational Mapper.

    Affected versions of this package are vulnerable to SQL Injection. Allows remote attackers to execute arbitrary SQL commands via the (1) limit, or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.

    How to fix SQL Injection?

    Upgrade SQLAlchemy to version 0.6.7 or higher.

    [,0.6.7)
    • H
    SQL Injection

    SQLAlchemy is a python SQL Toolkit and Object Relational Mapper.

    Affected versions of this package are vulnerable to SQL Injection when the group_by and order_by parameter can be controlled.

    NOTE: This vulnerability has also been identified as: CVE-2019-7548

    How to fix SQL Injection?

    Upgrade SQLAlchemy to version 1.2.18 or higher.

    [,1.2.18)
    • H
    SQL Injection

    SQLAlchemy is a python SQL Toolkit and Object Relational Mapper.

    Affected versions of this package are vulnerable to SQL Injection when the group_by and order_by parameter can be controlled.

    NOTE: This vulnerability has also been identified as: CVE-2019-7164

    How to fix SQL Injection?

    Upgrade SQLAlchemy to version 1.2.18 or higher.

    [,1.2.18)
    Go back to all versions of this package