Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2012-0369 advisory.

    [0.5.5-3]
    - sanitize inputs to limit() and offset()     Resolves: CVE-2012-0805

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201209-16 (SQLAlchemy: SQL injection)

    SQLAlchemy does not properly sanitize input passed from the &ldquo;limit&rdquo;
      and &ldquo;offset&rdquo; keywords to the select() function before using it in an       SQL query.
  Impact :

    A remote attacker could exploit this vulnerability to execute arbitrary       SQL statements.
  Workaround :

    There is no known workaround at this time.

It was discovered that SQLAlchemy did not sanitize values for the limit and offset keywords for SQL select statements. If an application using SQLAlchemy accepted values for these keywords, and did not filter or sanitize them before passing them to SQLAlchemy, it could allow an attacker to perform a SQL injection attack against the application (CVE-2012-0805).

The updated packages have been patched to correct this issue.

SQLAlchemy is an Object Relational Mapper (ORM) that provides a flexible, high-level interface to SQL databases.

It was discovered that SQLAlchemy did not sanitize values for the limit and offset keywords for SQL select statements. If an application using SQLAlchemy accepted values for these keywords, and did not filter or sanitize them before passing them to SQLAlchemy, it could allow an attacker to perform a SQL injection attack against the application. (CVE-2012-0805)

All users of python-sqlalchemy are advised to upgrade to this updated package, which contains a patch to correct this issue. All running applications using SQLAlchemy must be restarted for this update to take effect.

It was discovered that SQLAlchemy, a SQL toolkit and object relational mapper for Python, is not sanitizing input passed to the limit/offset keywords to select() as well as the value passed to select.limit()/offset(). This allows an attacker to perform SQL injection attacks against applications using SQLAlchemy that do not implement their own filtering.

- Fix the sqlalchemy0.5 backwards and forwards compat     packages for a security problem with limit.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated python-sqlalchemy package that fixes one security issue is now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

SQLAlchemy is an Object Relational Mapper (ORM) that provides a flexible, high-level interface to SQL databases.

It was discovered that SQLAlchemy did not sanitize values for the limit and offset keywords for SQL select statements. If an application using SQLAlchemy accepted values for these keywords, and did not filter or sanitize them before passing them to SQLAlchemy, it could allow an attacker to perform a SQL injection attack against the application. (CVE-2012-0805)

All users of python-sqlalchemy are advised to upgrade to this updated package, which contains a patch to correct this issue. All running applications using SQLAlchemy must be restarted for this update to take effect.

ID	Name	Product	Family	Severity
68492	Oracle Linux 6 : python-sqlalchemy (ELSA-2012-0369)	Nessus	Oracle Linux Local Security Checks	critical
62345	GLSA-201209-16 : SQLAlchemy: SQL injection	Nessus	Gentoo Local Security Checks	high
61949	Mandriva Linux Security Advisory : python-sqlalchemy (MDVSA-2012:059)	Nessus	Mandriva Local Security Checks	high
61278	Scientific Linux Security Update : python-sqlalchemy on SL6.x (20120307)	Nessus	Scientific Linux Local Security Checks	high
58728	Debian DSA-2449-1 : sqlalchemy - missing input sanitization	Nessus	Debian Local Security Checks	high
58687	Fedora 17 : python-sqlalchemy0.5-0.5.8-9.fc17 (2012-3373)	Nessus	Fedora Local Security Checks	high
58543	Fedora 15 : python-sqlalchemy0.5-0.5.8-9.fc15 (2012-3414)	Nessus	Fedora Local Security Checks	high
58542	Fedora 16 : python-sqlalchemy0.5-0.5.8-9.fc16 (2012-3412)	Nessus	Fedora Local Security Checks	high
58284	RHEL 6 : python-sqlalchemy (RHSA-2012:0369)	Nessus	Red Hat Local Security Checks	high
58276	CentOS 6 : python-sqlalchemy (CESA-2012:0369)	Nessus	CentOS Local Security Checks	high

Detections

Analytics

CVE-2012-0805

critical

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high