------------------------------------------------------------------------- Debian LTS Advisory DLA-2811-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Markus Koschany November 06, 2021 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : sqlalchemy Version : 1.0.15+ds1-1+deb9u1 CVE ID : CVE-2019-7164 CVE-2019-7548 Debian Bug : 922669 Two SQL injection vulnerabilities were discovered in SQLAlchemy, a SQL toolkit and Object Relational Mapper for Python, when the order_by or group_by parameters can be controlled by an attacker. Warning: The text coercion feature of SQLAlchemy is rarely used but the warning that has been previously emitted is now an ArgumentError or in case of the order_by() and group_by() parameters a CompileError. For Debian 9 stretch, these problems have been fixed in version 1.0.15+ds1-1+deb9u1. We recommend that you upgrade your sqlalchemy packages. For the detailed security status of sqlalchemy please refer to its security tracker page at: https://security-tracker.debian.org/tracker/sqlalchemy Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: This is a digitally signed message part