Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Debian · 9 | sqlalchemy | 1.0.15+ds1-1+deb9u1 |
Vulnerabilities 2
-
Critical 9.8
SQLAlchemy vulnerable to SQL Injection via order_by parameter
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
-
High 7.8
SQLAlchemy is vulnerable to SQL Injection via group_by parameter
SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.