RedHat has issued this advisory on March 7: https://rhn.redhat.com/errata/RHSA-2012-0369.html Cauldron is not vulnerable. It looks like this, and many other bugs, can be fixed by upgrading to 0.6.8. More info here; https://bugzilla.redhat.com/show_bug.cgi?id=783305
CC: (none) => makowski.mageia
Assignee: bugsquad => makowski.mageia
python-sqlalchemy-0.6.8-1.mga1 is in 1/core/updates_testing
Status: NEW => ASSIGNED
Thanks Philippe. Advisory: ======================== Updated python-sqlalchemy package fixes security vulnerability: It was discovered that SQLAlchemy did not sanitize values for the limit and offset keywords for SQL select statements. If an application using SQLAlchemy accepted values for these keywords, and did not filter or sanitize them before passing them to SQLAlchemy, it could allow an attacker to perform an SQL injection attack against the application (CVE-2012-0805). python-sqlalchemy has been updated to version 0.6.8 which fixes this vulnerability as well as several other bugs. Note: All running applications using SQLAlchemy must be restarted for this update to take effect. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0805 https://rhn.redhat.com/errata/RHSA-2012-0369.html ======================== Updated packages in core/updates_testing: ======================== python-sqlalchemy-0.6.8-1.mga1.i586.rpm from python-sqlalchemy-0.6.8-1.mga1.src.rpm
Assignee: makowski.mageia => qa-bugs
Testing complete on i586 for the srpm python-sqlalchemy-0.6.8-1.mga1.src.rpm Tested using gourmet as per https://bugs.mageia.org/show_bug.cgi?id=1738#c5
CC: (none) => davidwhodgins
Testing complete on x86_64 Suggested Advisory: ------------- Updated python-sqlalchemy package fixes security vulnerability: It was discovered that SQLAlchemy did not sanitize values for the limit and offset keywords for SQL select statements. If an application using SQLAlchemy accepted values for these keywords, and did not filter or sanitize them before passing them to SQLAlchemy, it could allow an attacker to perform an SQL injection attack against the application (CVE-2012-0805). python-sqlalchemy has been updated to version 0.6.8 which fixes this vulnerability as well as several other bugs. Note: All running applications using SQLAlchemy must be restarted for this update to take effect. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0805 https://rhn.redhat.com/errata/RHSA-2012-0369.html https://bugs.mageia.org/show_bug.cgi?id=5268 ------------- SRPM: python-sqlalchemy-0.6.8-1.mga1.src.rpm Could sysadmin please push from core/updates_testing to core/updates Thankyou!
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Update pushed
Status: ASSIGNED => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED