Skip to content
Fencer Vulns
critical 9.8

CVE-2019-7164 json

SQLAlchemy vulnerable to SQL Injection via order_by parameter

published 2019-02-20 7 y ago modified 2026-06-17 4 mo ago also GHSA-887w-45rq-vxgf , PYSEC-2019-123 , EUVD-2019-0133

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.5%
EPSS 3.5% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known

Summary

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.

Patch / fix

  • pypi sqlalchemy 1.3.0b3
  • sqlalchemy Debian 14, Debian 13, Debian 12 1.2.18+ds1-2

debian advisories DEBIAN-CVE-2019-7164

  • scipy RHEL 8 1.0.0-19.module+el8.0.0+2966+d39a1df3
  • python36 RHEL 8 3.6.8-2.module+el8.0.0+2975+e0f02136
  • python-nose RHEL 8 1.3.7-30.module+el8.0.0+2966+d39a1df3
  • python-wheel RHEL 8 1:0.30.0-13.module+el8.0.0+2966+d39a1df3
  • python3-bson RHEL 8 3.6.1-9.module+el8.0.0+2966+d39a1df3
  • python3-nose RHEL 8 1.3.7-30.module+el8.0.0+2966+d39a1df3
  • python3-scipy RHEL 8 1.0.0-19.module+el8.0.0+2966+d39a1df3
  • python3-wheel RHEL 8 1:0.30.0-13.module+el8.0.0+2966+d39a1df3

red hat advisories RHSA-2019:0984RHSA-2019:0981

  • python-SQLAlchemy SLE Module for Package Hub 15 SP1, SLE Module for Basesystem 15 SP1 1.2.14-6.3.1
  • ardana-db OpenStack Cloud 9 9.0+git.1564409964.b7e4fc3-3.7.2
  • ardana-mq OpenStack Cloud 9 9.0+git.1565115025.148d092-3.7.2
  • ardana-ses OpenStack Cloud 9 9.0+git.1565962617.523149b-3.7.2
  • crowbar-ha OpenStack Cloud Crowbar 9 6.0+git.1566406179.7549de2-3.7.2
  • crowbar-ui OpenStack Cloud Crowbar 9 1.3.0+git.1563181545.65360af5-8.1
  • ardana-heat OpenStack Cloud 9 9.0+git.1565721273.f44b8d7-3.7.2
  • ardana-nova OpenStack Cloud 9 9.0+git.1566332515.e232568-3.7.2

suse advisories SUSE-SU-2019:2253-2SUSE-SU-2019:2267-1SUSE-SU-2019:2374-1SUSE-SU-2019:2350-1SUSE-SU-2019:2261-1SUSE-SU-2019:2253-1

  • python-SQLAlchemy openSUSE Tumbleweed 1.4.22-1.2
  • python-SQLAlchemy openSUSE Tumbleweed 1.4.46-2.1
  • python-SQLAlchemy Package Hub 15 1.2.7-bp150.2.3.1
  • python-SQLAlchemy openSUSE Leap 15.1 1.2.14-lp151.2.3.1
  • python-SQLAlchemy openSUSE Leap 15.0 1.2.7-lp150.2.3.1

opensuse advisories openSUSE-SU-2024:11211-1openSUSE-SU-2024:12915-1openSUSE-SU-2019:2078-1openSUSE-SU-2019:2064-1openSUSE-SU-2019:2039-1

  • python3-docutils AlmaLinux 8 0.14-12.module_el8.5.0+2569+5c5719bc
  • python3-docutils AlmaLinux 8 0.14-12.module_el8.5.0+135+5ce32bc4
  • python2-py AlmaLinux 8 1.5.3-6.module_el8.6.0+2781+fed64c13
  • python2-idna AlmaLinux 8 2.5-7.module_el8.6.0+2781+fed64c13
  • python2-mock AlmaLinux 8 2.0.0-13.module_el8.6.0+2781+fed64c13
  • python2-pytz AlmaLinux 8 2017.2-12.module_el8.6.0+2781+fed64c13
  • python2-attrs AlmaLinux 8 17.4.0-10.module_el8.6.0+2781+fed64c13
  • python2-Cython AlmaLinux 8 0.28.1-7.module_el8.6.0+2781+fed64c13

almalinux advisories ALSA-2019:0984ALSA-2019:0981

  • python36 Rocky Linux 8 3.6.8-2.module+el8.3.0+120+426d8baf
  • python-nose Rocky Linux 8 1.3.7-30.module+el8.3.0+120+426d8baf
  • python-PyMySQL Rocky Linux 8 0.8.0-10.module+el8.5.0+706+735ec4b3
  • python-PyMySQL Rocky Linux 8 0.8.0-10.module+el8.3.0+120+426d8baf
  • python-docutils Rocky Linux 8 0.14-12.module+el8.4.0+403+9ae17a31
  • python-docutils Rocky Linux 8 0.14-12.module+el8.3.0+120+426d8baf
  • python-pygments Rocky Linux 8 2.2.0-20.module+el8.3.0+120+426d8baf
  • pytz Rocky Linux 8 2017.2-12.module+el8.5.0+706+735ec4b3

rocky linux advisories RLSA-2019:0984RLSA-2019:0981

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-7164 updated cvss 7.3

python-sqlalchemy: SQL Injection when the order_by parameter can be controlled

  • Red Hat Ceph Storage 2 calamari-server Red Hat Enterprise Linux 6 python-sqlalchemy Red Hat Enterprise Linux 7 python-sqlalchemy Red Hat OpenStack Platform 8 (Liberty) python-sqlalchemy Red Hat OpenStack Platform 9 (Mitaka) python-sqlalchemy
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 10 (Newton) python-sqlalchemy Red Hat OpenStack Platform 13 (Queens) python2-sqlalchemy Red Hat OpenStack Platform 14 (Rocky) python2-sqlalchemy Red Hat OpenStack Platform 15 (Stein) python-sqlalchemy
    affected: no fix available
  • Red Hat Software Collections python27-python-sqlalchemy, rh-python35-python-sqlalchemy, rh-python36-python-sqlalchemy
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux AppStream (v. 8) babel 2.5.1-9.module+el8.0.0+2961+596d0223, pytz 2017.2-12.module+el8.0.0+2961+596d0223, PyYAML 3.12-16.module+el8.0.0+2961+596d0223, scipy 1.0.0-19.module+el8.0.0+2961+596d0223, scipy 1.0.0-19.module+el8.0.0+2966+d39a1df3, Cython 0.28.1-7.module+el8.0.0+2961+596d0223, +103 more
    fixed: vendor fix RHSA-2019:0981

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.50% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/sqlalchemy/sqlalchemy/issues/4481 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi sqlalchemy
<1.3.0b3
1.3.0b3

Classification

Weakness
  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.