CVE-2019-7164: SQLAlchemy vulnerable to SQL Injection via order_by parameter

Executive brief

SQLAlchemy before 1.3.0b3 allows SQL Injection via the order_by parameter. The fix (commit 30307c4) was applied only to the main branch and was never backported to the 1.2.x release line; all 1.2.x versions remain vulnerable.

Affected products

• PyPI SQLAlchemy

References

• https://api.github.com/users/DEVSOG12
• https://github.com/DEVSOG12
• https://api.github.com/users/DEVSOG12/gists%7B/gist_id%7D
• https://api.github.com/users/DEVSOG12/repos
• https://avatars.githubusercontent.com/u/54543298?v=4
• https://api.github.com/users/DEVSOG12/events%7B/privacy%7D