WaratekVRT Sign in

CVE-2019-7164 SQLAlchemy

Affected softwareSQLAlchemy
Severity9.8 Critical CVSS 3.1 2 scores
WeaknessSQL injection (CWE-89)
Published20 Feb 2019
Updated17 Jun 2026

Description

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 7 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 3.5% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 7.5 none AV:N/AC:L/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update January 2021 ↗ CPU 2021-Q1 Oracle Communications / ORMB DB Query in VSP (SQLAlchemy) (4.2, 4.3)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications ORMB DB Query in VSP (SQLAlchemy) 4.2, 4.3 4.2 · 4.3

Products and versions

9 products, 18 version entries
SourceVendorProductSchemeAffected versions
nvd debian debian linux generic 8.0 · 9.0
nvd opensuse backports sle generic 15.0
nvd opensuse leap generic 15.0 · 15.1
nvd oracle communications operations monitor generic 4.2 · 4.3
nvd redhat enterprise linux generic 8.0
nvd redhat enterprise linux eus generic 8.1 · 8.2 · 8.4
nvd redhat enterprise linux server aus generic 8.2 · 8.4
nvd redhat enterprise linux server tus generic 8.2 · 8.4
nvd sqlalchemy sqlalchemy generic ≤ 1.2.17 · 1.3.0:beta1 · 1.3.0:beta2

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** HTTP, ORMB DB QUERY IN VSP (SQLALCHEMY), NO AUTH REMOTE EXPLOIT **Products:** PYTHON-SQLALCHEMY, ORACLE COMMUNICATIONS OPERATIONS MONITOR, ORACLE COMMUNICATIONS

References

URLTags
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00087.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00010.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00016.html Mailing List, Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0981 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0984 Third Party Advisory
https://github.com/sqlalchemy/sqlalchemy/issues/4481 Exploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/03/msg00020.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00005.html Mailing List, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html Patch, Third Party Advisory

Timeline
Published2019-02-20By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.