Quick answers
- Is CVE-2019-7548 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2019-7548 being exploited in the wild.
- How severe is CVE-2019-7548?
- Low severity, with a CVSS score of 3, published 6 February 2019.
- Which products and versions are affected?
- SQLAlchemy (PyPI) ECOSYSTEM:introduced=0,fixed=1.2.18, ECOSYSTEM:introduced=0,fixed=1.2.19.
- Is there a fix for CVE-2019-7548?
- Yes. SQLAlchemy (PyPI): upgrade to 1.2.18, 1.2.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2019-7548 attacked?
- It is attacked over the network.
- Am I affected by CVE-2019-7548?
- Check whether you run SQLAlchemy (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- SQLAlchemy (PyPI): upgrade to 1.2.18, 1.2.19 or later
pip install "SQLAlchemy>=1.2.19"
Technical details
SQLAlchemy 1.2.17 and earlier versions are vulnerable to SQL injection through the group_by parameter when it accepts unvalidated string input. The vulnerability is rooted in insufficient input sanitization that allows attacker-controlled text to be directly concatenated into SQL queries. The attack vector is network-reachable if the vulnerable code is part of a web application, and no authentication is required—only that untrusted input reaches the group_by parameter. An attacker can craft malicious SQL fragments to bypass intended query logic, extract sensitive data, or manipulate database state. The vulnerability was patched in SQLAlchemy 1.2.19; users should upgrade immediately.
Affected products
- SQLAlchemy SQLAlchemy 0.1.0 through 1.2.18
Identifiers
- CVE-2019-7548
- GHSA-38fc-9xqv-7f7q
- PYSEC-2019-124
Timeline
- 2019-02-06: disclosed
- 2019-04-16: advisory
- 2019: patched: Fixed in SQLAlchemy 1.2.19