VDB
Sign up
—

PYSEC-2012-9

Quick fix

PYSEC-2012-9 — sqlalchemy: upgrade to the fixed version with the command below.

pip install --upgrade 'sqlalchemy>=0.7.0'

Details

Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/sqlalchemy
Introduced in: 0Fixed in: 0.7.0
Fixpip install --upgrade 'sqlalchemy>=0.7.0'

References