Bug 1674059 (CVE-2019-7548)

Summary:	CVE-2019-7548 python-sqlalchemy: SQL Injection when the group_by parameter can be controlled
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	apevec, dbecker, dciabrin, hhorak, hvyas, jjoyce, jorton, jschluet, kbasil, lhh, lpeer, mbayer, mburns, python-maint, sclewis, sisharma, slinaber
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:47:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1674060, 1678523, 1678524, 1678525, 1678526, 1678527, 1678528, 1678530, 1678531, 1678532, 1678533, 1678534, 1678535, 1678733, 1693968, 1693978, 1695754, 1697624
Bug Blocks:	1674063

Description Laura Pardo 2019-02-08 22:01:55 UTC

A vulnerability was found in SQLAlchemy 1.2.17. An SQL Injection when the group_by parameter can be controlled.


References:
https://github.com/no-security/sqlalchemy_test

Comment 1 Laura Pardo 2019-02-08 22:02:07 UTC

Created python-sqlalchemy tracking bugs for this issue:

Affects: fedora-all [bug 1674060]

Comment 2 Joshua Padman 2019-02-15 12:31:06 UTC

Red Hat OpenStack uses the python-sqlalchemy library and the versions provided contain the vulnerable code. However, the vulnerability is not exposed in a way that would be exploitable within a Red Hat OpenStack installation.

Comment 3 Doran Moppert 2019-02-19 02:10:28 UTC

This flaw is related to CVE-2019-7164 (bug 1678520) and is fixed by the same upstream patch.

Upstream patch:

https://github.com/sqlalchemy/sqlalchemy/commit/30307c4616ad67c01ddae2e1e8e34fabf6028414

Comment 4 Doran Moppert 2019-02-19 02:12:02 UTC

This issue has been rated Moderate because it is not common in SQLAlchemy backed applications for the group_by parameter to be populated by an externally-controlled string. The upstream issue has more discussion about safe use of group_by and order_by.

Comment 9 Michael Bayer 2019-02-20 16:25:15 UTC

Hi Hardik -

can you please clarify that you are aware of an application that is passing untrusted input to group_by()?   Note there are many functions and methods in SQLAlchemy which accept SQL string fragments that are rendered as-is, as they are expected to be just that, SQL fragments.

Comment 10 Hardik Vyas 2019-02-21 08:35:43 UTC

Hello Michael,

No, I looked into calamari-server only. In Ceph, SQLAlchemy is used in calamari server. I can't see any way to exploit the calamari webapp via a web browser in a meaningful way. Marked Ceph as affected based on presence of vulnerable code and positive results from the POC against the bundled version 0.8.3 of python-sqlalchemy. I'll modify the flaw statement accordingly for the Ceph product to be more sensible.

Comment 11 Hardik Vyas 2019-02-21 08:36:31 UTC

Statement:

This issue affects the versions of python-sqlalchemy(bundled in calamari-server) shipped with Red Hat Ceph Storage 2. However, this flaw is not known to be exploitable in any meaningful way within calamari webapp. A future update may address this issue.

Comment 13 errata-xmlrpc 2019-05-07 04:19:58 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:0981 https://access.redhat.com/errata/RHSA-2019:0981

Comment 14 errata-xmlrpc 2019-05-07 04:20:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:0984 https://access.redhat.com/errata/RHSA-2019:0984