CVE:CVE-2019-7548
CNNVD:CNNVD-201902-136
SQLAlchemy是一款基于Python的开源数据库ORM软件。该产品主要提供SQL工具包及对象关系映射工具。
SQLAlchemy 1.2.17版本中存在SQL注入漏洞。远程攻击者可借助group_by参数发送特制的SQL语句利用该漏洞查看、添加、修改或删除后端数据库中的信息。
solution:Upgrade sqlalchemy sqlalchemy to a higher version than 1.2.17,and avoid the version 1.2.17; Upgrade debian debian_linux to a higher version than 8.0,9.0,and avoid the version 8.0,9.0; Upgrade opensuse backports_sle to a higher version than 15.0,and avoid the version 15.0; Upgrade opensuse leap to a higher version than 15.0,15.1,and avoid the version 15.0,15.1; Upgrade redhat enterprise_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade redhat enterprise_linux_eus to a higher version than 8.1,8.2,8.4,and avoid the version 8.1,8.2,8.4; Upgrade redhat enterprise_linux_server_aus to a higher version than 8.2,8.4,and avoid the version 8.2,8.4; Upgrade redhat enterprise_linux_server_tus to a higher version than 8.2,8.4,and avoid the version 8.2,8.4; Upgrade oracle communications_operations_monitor to a higher version than 4.2,4.3,and avoid the version 4.2,4.3