Read the docs
TI-2012-00742 Aliases CVE-2012-0805GHSA-hfg2-wf6j-x53p

Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone…

Priority LOW 38CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-89.

Summary

Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.

Why it matters now

EPSS 0.0283 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed SQLAlchemy (PyPI): 0.7.0b4Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—SQLAlchemy (PyPI)before 0.7.0b40.7.0b4Patch availableGHSA-hfg2-wf6j-x53p
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • SQLAlchemy (PyPI) Vendor— Affected before 0.7.0b4 Fixed in 0.7.0b4 Patch available GHSA-hfg2-wf6j-x53p

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:a:sqlalchemy:sqlalchemy:*:b3:*:*:*:*:*:*up to 0.7.0Vulnerablesqlalchemy
cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.0:*:*:*:*:*:*:*0.6.0Vulnerablesqlalchemy
cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.0:beta1:*:*:*:*:*:*0.6.0 beta1Vulnerablesqlalchemy
cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.0:beta2:*:*:*:*:*:*0.6.0 beta2Vulnerablesqlalchemy
cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.0:beta3:*:*:*:*:*:*0.6.0 beta3Vulnerablesqlalchemy
cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.1:*:*:*:*:*:*:*0.6.1Vulnerablesqlalchemy
cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.2:*:*:*:*:*:*:*0.6.2Vulnerablesqlalchemy
cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.3:*:*:*:*:*:*:*0.6.3Vulnerablesqlalchemy
cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.4:*:*:*:*:*:*:*0.6.4Vulnerablesqlalchemy
cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.5:*:*:*:*:*:*:*0.6.5Vulnerablesqlalchemy
  • cpe:2.3:a:sqlalchemy:sqlalchemy:*:b3:*:*:*:*:*:* Versions up to 0.7.0 Vulnerable ·sqlalchemy
  • cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.0:*:*:*:*:*:*:* Versions 0.6.0 Vulnerable ·sqlalchemy
  • cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.0:beta1:*:*:*:*:*:* Versions 0.6.0 beta1 Vulnerable ·sqlalchemy
  • cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.0:beta2:*:*:*:*:*:* Versions 0.6.0 beta2 Vulnerable ·sqlalchemy
  • cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.0:beta3:*:*:*:*:*:* Versions 0.6.0 beta3 Vulnerable ·sqlalchemy
  • cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.1:*:*:*:*:*:*:* Versions 0.6.1 Vulnerable ·sqlalchemy
  • cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.2:*:*:*:*:*:*:* Versions 0.6.2 Vulnerable ·sqlalchemy
  • cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.3:*:*:*:*:*:*:* Versions 0.6.3 Vulnerable ·sqlalchemy
  • cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.4:*:*:*:*:*:*:* Versions 0.6.4 Vulnerable ·sqlalchemy
  • cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.5:*:*:*:*:*:*:* Versions 0.6.5 Vulnerable ·sqlalchemy
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.6:*:*:*:*:*:*:*0.6.6Vulnerablesqlalchemy
cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.7:*:*:*:*:*:*:*0.6.7Vulnerablesqlalchemy
cpe:2.3:a:sqlalchemy:sqlalchemy:0.7.0:b1:*:*:*:*:*:*0.7.0 b1Vulnerablesqlalchemy
cpe:2.3:a:sqlalchemy:sqlalchemy:0.7.0:b2:*:*:*:*:*:*0.7.0 b2Vulnerablesqlalchemy
  • cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.6:*:*:*:*:*:*:* Versions 0.6.6 Vulnerable ·sqlalchemy
  • cpe:2.3:a:sqlalchemy:sqlalchemy:0.6.7:*:*:*:*:*:*:* Versions 0.6.7 Vulnerable ·sqlalchemy
  • cpe:2.3:a:sqlalchemy:sqlalchemy:0.7.0:b1:*:*:*:*:*:* Versions 0.7.0 b1 Vulnerable ·sqlalchemy
  • cpe:2.3:a:sqlalchemy:sqlalchemy:0.7.0:b2:*:*:*:*:*:* Versions 0.7.0 b2 Vulnerable ·sqlalchemy

Remediation

  • Fix · GHSA-hfg2-wf6j-x53p SQLAlchemy (PyPI) Fixed in 0.7.0b4 Advisory →

Red Hat 1 advisory

  • RHSA-2012:0369 Released 2012-03-07 · Red Hat rating Moderate
    python-sqlalchemy security update
    • Red Hat Enterprise Linux Server (v. 6) python-sqlalchemy-0.5.5-3.el6_2
    • Red Hat Enterprise Linux Workstation (v. 6) python-sqlalchemy-0.5.5-3.el6_2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2012:0369
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2012:0369

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-0805
  2. 2026-10-03 Alias added: GHSA-hfg2-wf6j-x53p

References

Exploit 1

Advisory 4

Other 9

  • TI-2019-05082 SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. CVSS 3.1CRITICAL 9.8
  • TI-2019-05329 SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled. CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences