CVE-2012-0805

CRITICAL9.8EPSS 1.6%

sqlalchemy - missing input sanitization

Published: 5/14/2022Modified: 4/28/2026

Also known as:DEBIAN-CVE-2012-0805

Description

Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.

Affected packages (4)

Debian/sqlalchemyfrom 0, < 0.6.7-1
Debian/sqlalchemyfrom 0, < 0.6.3-3+squeeze1
PyPI/sqlalchemyfrom 0, < 0.7.0b4
PyPI/sqlalchemyfrom 0, < 0.7.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (19)

ADVISORYhttp://secunia.com/advisories/48327
ADVISORYhttp://secunia.com/advisories/48328
ADVISORYhttp://secunia.com/advisories/48771
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2012-0805
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2012-0805
ADVISORYhttp://www.mandriva.com/security/advisories?name=MDVSA-2012:059
PATCHhttps://github.com/sqlalchemy/sqlalchemy
WEBhttp://rhn.redhat.com/errata/RHSA-2012-0369.html
WEBhttps://bugs.launchpad.net/keystone/+bug/918608
WEBhttps://exchange.xforce.ibmcloud.com/vulnerabilities/73756
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/sqlalchemy/PYSEC-2012-9.yaml
WEBhttps://github.com/sqlalchemy/sqlalchemy/commit/51fea2e159ca93daa0bc8066a5c35d8436d99418
WEBhttps://web.archive.org/web/20140721183117/http://secunia.com/advisories/48771
WEBhttps://web.archive.org/web/20140802043526/http://secunia.com/advisories/48328
WEBhttps://web.archive.org/web/20140802044957/http://secunia.com/advisories/48327
WEBhttp://www.debian.org/security/2012/dsa-2449
WEBhttp://www.sqlalchemy.org/changelog/CHANGES_0_7_0
WEBhttp://www.sqlalchemy.org/trac/changeset/852b6a1a87e7
WEBhttp://www.sqlalchemy.org/trac/changeset/852b6a1a87e7/