CVE-2019-7548: debian debian_linux

Modified

AliasesGHSA-38fc-9xqv-7f7qPYSEC-2019-124UBUNTU-CVE-2019-7548+1 more

Published 06-02-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-7548 is a high (CVSS 7.8) vulnerability in debian debian_linux. EPSS estimates a 1.78% chance of exploitation in the next 30 days, higher than 78.2% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v3.1 (NVD)

EPSS score

1.78%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 14 · Related 9

DLA-1718-1 DLA-2811-1 MGASA-2019-0350 OPENSUSE-SU-2019:2039-1 OPENSUSE-SU-2019:2064-1 OPENSUSE-SU-2019:2078-1+8 more

Timeline

06-02-2019
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.

CVSS metrics

6 scores · 4 sources · 4 versions

v4.09.3v3.17.8v3.07.8v2.06.8

EPSS trend

Probability

1.78%

Chance of exploitation in the next 30 days

Percentile

78%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.78% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Sqlalchemy Test
Maturity: poc

Weaknesses

CWE · root cause

CWE-89Improper Neutralization of Special Elements used in an SQL CommandThe product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected systems

Version check

Known conditions: local access, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat4 products

Debian2 products

sqlalchemy< 1.2.18+ds1-2
debian_linuxEOL8.0 | 9.0

Opensuse2 products

backports_sle15.0
leapEOL15.0 | 15.1

Oracle1 product

communications_operations_monitor4.2 | 4.3

PyPI1 product

sqlalchemy< 1.2.19 | < 1.2.18

Sqlalchemy1 product

sqlalchemy1.2.17

Ubuntu1 product

sqlalchemyAll versions (No fix recorded)

7 vendors · 12 products

References

18 links

lists.debian.org/debian-lts-announce/2019/03/msg00020.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
access.redhat.com/errata/RHSA-2019:0984Vendor AdvisoryX Refsource REDHATWEBAdvisoryThird Party Advisory
access.redhat.com/errata/RHSA-2019:0981Vendor AdvisoryX Refsource REDHATWEBAdvisoryThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.htmlVendor AdvisoryX Refsource SUSEWEBMailing ListThird Party Advisory
www.oracle.com/security-alerts/cpujan2021.htmlX Refsource MISCWEBPatchThird Party Advisory
github.com/sqlalchemy/sqlalchemy/issues/4481X Refsource MISCWEBREPORTPatchThird Party Advisory
github.com/no-security/sqlalchemy_testX Refsource MISCWEBREPORTExploitThird Party Advisory
lists.debian.org/debian-lts-announce/2021/11/msg00005.htmlMailing ListX Refsource MLISTWEBThird Party Advisory

Show all 18 references