| Summary: | <dev-python/sqlalchemy-1.3.3: SQL Injection when the order_by parameter can be controlled (CVE-2019-7164) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | mgorny, python, vdupras |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://bugzilla.redhat.com/show_bug.cgi?id=1678520 | ||
| Whiteboard: | B3 [noglsa cve] | ||
| Package list: |
dev-python/sqlalchemy-1.3.3
|
Runtime testing required: | --- |
| Bug Depends on: | 670896 | ||
| Bug Blocks: | |||
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=74d676f319dab3f9e24d291d20906ca90b83196a commit 74d676f319dab3f9e24d291d20906ca90b83196a Author: Virgil Dupras <vdupras@gentoo.org> AuthorDate: 2019-04-29 12:12:54 +0000 Commit: Virgil Dupras <vdupras@gentoo.org> CommitDate: 2019-04-29 12:13:49 +0000 dev-python/sqlalchemy: bump to 1.3.3 Bug: https://bugs.gentoo.org/678480 Signed-off-by: Virgil Dupras <vdupras@gentoo.org> Package-Manager: Portage-2.3.62, Repoman-2.3.11 dev-python/sqlalchemy/Manifest | 1 + dev-python/sqlalchemy/sqlalchemy-1.3.3.ebuild | 63 +++++++++++++++++++++++++++ 2 files changed, 64 insertions(+) Issue 4481 was addressed in upstream's 1.3 release. Arches, please stabilize. Thanks! ppc stable ppc64 stable amd64 stable sparc stable The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=06272e72a051f00d166ee600a04603b86a39ec9e commit 06272e72a051f00d166ee600a04603b86a39ec9e Author: Tobias Klausmann <klausman@gentoo.org> AuthorDate: 2019-05-06 18:03:49 +0000 Commit: Tobias Klausmann <klausman@gentoo.org> CommitDate: 2019-05-06 18:04:08 +0000 dev-python/sqlalchemy-1.3.3-r0: alpha stable Bug: http://bugs.gentoo.org/678480 Signed-off-by: Tobias Klausmann <klausman@gentoo.org> dev-python/sqlalchemy/sqlalchemy-1.3.3.ebuild | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) arm stable arm64 stable x86 stable hppa stable s390 stable ia64 stable Cleanup done. Resetting sanity check; keywords are not fully specified and arches are not CC-ed. GLSA Vote: No Thank you all for you work. Closing as [noglsa]. |
From ${URL} : A vulnerability was found in SQLAlchemy 1.2.17. An SQL Injection when the order_by parameter can be controlled. Upstream issue: https://github.com/sqlalchemy/sqlalchemy/issues/4481 Upstream patch: https://github.com/sqlalchemy/sqlalchemy/commit/30307c4616ad67c01ddae2e1e8e34fabf6028414 @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.