SQL Injection Vulnerabilities in SQLAlchemy Affecting Keystone

CVE-2012-0805

What is CVE-2012-0805?

Multiple SQL injection vulnerabilities exist in SQLAlchemy, specifically versions prior to 0.7.0b4, utilized in Keystone. These vulnerabilities permit remote attackers to execute arbitrary SQL commands by exploiting the (1) limit or (2) offset keywords within the select function. Additionally, other unspecified vectors within the (3) select.limit or (4) select.offset functions pose risks, enabling unvalidated input to compromise the database integrity.

References