CVE:CVE-2019-7164
CNNVD:CNNVD-201902-752
SQLAlchemy是一款基于Python的开源数据库ORM软件。该产品主要提供SQL工具包及对象关系映射工具。
SQLAlchemy 1.2.17及之前版本和1.3.x版本至1.3.0b2版本中存在SQL注入漏洞。远程攻击者可借助‘order_by’参数利用该漏洞执行SQL命令。
solution:Upgrade sqlalchemy sqlalchemy to a higher version than 1.2.17,1.3.0:beta1,1.3.0:beta2,and avoid the version (,1.2.17],1.3.0:beta1,1.3.0:beta2; Upgrade debian debian_linux to a higher version than 8.0,9.0,and avoid the version 8.0,9.0; Upgrade opensuse backports_sle to a higher version than 15.0,and avoid the version 15.0; Upgrade opensuse leap to a higher version than 15.0,15.1,and avoid the version 15.0,15.1; Upgrade redhat enterprise_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade redhat enterprise_linux_eus to a higher version than 8.1,8.2,8.4,and avoid the version 8.1,8.2,8.4; Upgrade redhat enterprise_linux_server_aus to a higher version than 8.2,8.4,and avoid the version 8.2,8.4; Upgrade redhat enterprise_linux_server_tus to a higher version than 8.2,8.4,and avoid the version 8.2,8.4; Upgrade oracle communications_operations_monitor to a higher version than 4.2,4.3,and avoid the version 4.2,4.3