diff options
| author | Sylvain Beucler <beuc@beuc.net> | 2019-03-18 15:10:52 +0100 |
|---|---|---|
| committer | Sylvain Beucler <beuc@beuc.net> | 2019-03-18 15:16:25 +0100 |
| commit | aa1da0d3ae63eb610830e024db0b1898e8deda1c (patch) | |
| tree | c02b7a2fe3d0acd275a059795d73e506e1f53066 | |
| parent | b1a3c36f392931ad53a812786415f17b3665cd50 (diff) | |
DLA-1718-1 advisory
| -rw-r--r-- | english/lts/security/2019/dla-1718.data | 10 | ||||
| -rw-r--r-- | english/lts/security/2019/dla-1718.wml | 34 |
2 files changed, 44 insertions, 0 deletions
diff --git a/english/lts/security/2019/dla-1718.data b/english/lts/security/2019/dla-1718.data new file mode 100644 index 00000000000..fad725513f8 --- /dev/null +++ b/english/lts/security/2019/dla-1718.data @@ -0,0 +1,10 @@ +<define-tag pagetitle>DLA-1718-1 sqlalchemy</define-tag> +<define-tag report_date>2019-03-18</define-tag> +<define-tag secrefs>CVE-2019-7164 CVE-2019-7548 Bug#922669</define-tag> +<define-tag packages>sqlalchemy</define-tag> +<define-tag isvulnerable>yes</define-tag> +<define-tag fixed>yes</define-tag> +<define-tag fixed-section>no</define-tag> + +#use wml::debian::security + diff --git a/english/lts/security/2019/dla-1718.wml b/english/lts/security/2019/dla-1718.wml new file mode 100644 index 00000000000..6bd290600ae --- /dev/null +++ b/english/lts/security/2019/dla-1718.wml @@ -0,0 +1,34 @@ +<define-tag description>LTS security update</define-tag> +<define-tag moreinfo> + +<p>Two vulnerabilities were discovered in SQLALchemy, a Python SQL +Toolkit and Object Relational Mapper.</p> + +<ul> + +<li><a href="https://security-tracker.debian.org/tracker/CVE-2019-7164">CVE-2019-7164</a> + + <p>SQLAlchemy allows SQL Injection via the order_by parameter.</p></li> + +<li><a href="https://security-tracker.debian.org/tracker/CVE-2019-7548">CVE-2019-7548</a> + + <p>SQLAlchemy has SQL Injection when the group_by parameter can be controlled.</p></li> + +</ul> + +<p>The SQLAlchemy project warns that these security fixes break the +seldom-used text coercion feature.</p> + +<p>For Debian 8 <q>Jessie</q>, these problems have been fixed in version +0.9.8+dfsg-0.1+deb8u1.</p> + +<p>We recommend that you upgrade your sqlalchemy packages.</p> + +<p>Further information about Debian LTS security advisories, how to apply +these updates to your system and frequently asked questions can be +found at: <a href="https://wiki.debian.org/LTS">https://wiki.debian.org/LTS</a></p> +</define-tag> + +# do not modify the following line +#include "$(ENGLISHDIR)/lts/security/2019/dla-1718.data" +# $Id: $ |