CVE-2019-7164: debian debian_linux

Modified

AliasesGHSA-887w-45rq-vxgfPYSEC-2019-123UBUNTU-CVE-2019-7164+3 more

Published 20-02-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-7164 is a critical (CVSS 9.8) vulnerability in debian debian_linux. EPSS estimates a 3.52% chance of exploitation in the next 30 days, higher than 89.2% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (NVD)

EPSS score

3.52%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 14 · Related 9

DLA-1718-1 DLA-2811-1 MGASA-2019-0350 OPENSUSE-SU-2019:2039-1 OPENSUSE-SU-2019:2064-1 OPENSUSE-SU-2019:2078-1+8 more

Timeline

20-02-2019
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.

CVSS metrics

6 scores · 4 sources · 4 versions

v4.09.3v3.19.8v3.09.8v2.07.5

EPSS trend

Probability

3.52%

Chance of exploitation in the next 30 days

Percentile

89%

Versus all other CVEs

30-day change

No change 0.00 pp

From 3.52% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Sqlalchemy
Maturity: poc

Weaknesses

CWE · root cause

CWE-89Improper Neutralization of Special Elements used in an SQL CommandThe product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat4 products

Opensuse3 products

backports_sle15.0
leapEOL15.0 | 15.1
python-SQLAlchemy&distro=openSUSE Tumbleweed< 1.4.46-2.1 | < 1.4.22-1.2

Debian2 products

sqlalchemy< 1.2.18+ds1-2
debian_linuxEOL8.0 | 9.0

Oracle1 product

communications_operations_monitor4.2 | 4.3

PyPI1 product

sqlalchemy< 1.3.0b3

Sqlalchemy1 product

sqlalchemy≤ 1.2.17 | 1.3.0:beta1 | 1.3.0:beta2

Ubuntu1 product

sqlalchemyAll versions (No fix recorded)

7 vendors · 13 products

References

18 links

lists.debian.org/debian-lts-announce/2019/03/msg00020.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
access.redhat.com/errata/RHSA-2019:0984Vendor AdvisoryX Refsource REDHATWEBAdvisoryThird Party Advisory
access.redhat.com/errata/RHSA-2019:0981Vendor AdvisoryX Refsource REDHATWEBAdvisoryThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
www.oracle.com/security-alerts/cpujan2021.htmlX Refsource MISCWEBPatchThird Party Advisory
github.com/sqlalchemy/sqlalchemy/issues/4481X Refsource MISCWEBREPORTExploitThird Party Advisory
lists.debian.org/debian-lts-announce/2021/11/msg00005.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
nvd.nist.gov/vuln/detail/CVE-2019-7164Advisory

Show all 18 references