Bug#922669: sqlalchemy: CVE-2019-7164 CVE-2019-7548 (SQL injection)

2019-05-06 Thread Ross Vandegrift
On Mon, May 06, 2019 at 10:20:25AM +0200, Thomas Goirand wrote: > On 5/6/19 5:09 AM, Ross Vandegrift wrote: > > Source: sqlalchemy > > Version: 1.2.18+ds1 > > Followup-For: Bug #922669 > > > > I've confirmed that 1.2.18+ds1 is affected despite the description at [1]. > > Upstream has a patch for t

Bug#922669: sqlalchemy: CVE-2019-7164 CVE-2019-7548 (SQL injection)

2019-05-06 Thread Thomas Goirand
On 5/6/19 5:09 AM, Ross Vandegrift wrote: > Source: sqlalchemy > Version: 1.2.18+ds1 > Followup-For: Bug #922669 > > I've confirmed that 1.2.18+ds1 is affected despite the description at [1]. > Upstream has a patch for the 1.2 series at [2]. > > A debdiff including the patch is attached. It buil

Bug#922669: sqlalchemy: CVE-2019-7164 CVE-2019-7548 (SQL injection)

2019-05-05 Thread Ross Vandegrift
Source: sqlalchemy Version: 1.2.18+ds1 Followup-For: Bug #922669 I've confirmed that 1.2.18+ds1 is affected despite the description at [1]. Upstream has a patch for the 1.2 series at [2]. A debdiff including the patch is attached. It builds and the tests pass. However, the fix requires removing

Bug#922669: sqlalchemy: CVE-2019-7164 CVE-2019-7548

2019-02-18 Thread Salvatore Bonaccorso
Source: sqlalchemy Version: 1.2.15+ds1-1 Severity: important Tags: security upstream Hi, The following vulnerabilities were published for sqlalchemy. CVE-2019-7164[0]: | SQL Injection when the order_by parameter can be controlled CVE-2019-7548[1]: | SQLAlchemy 1.2.17 has SQL Injection when the