CVE-2012-0805: Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote atta...

Security readout for executives and security teams

CVE-2012-0805 is an SQL injection flaw in SQLAlchemy before 0.7.0b4, including use in Keystone. If exposed application code lets remote input influence affected limit or offset query paths, an attacker could execute arbitrary SQL against the backing database. Exposure is most likely in legacy Python services using SQLAlchemy before 0.7.0b4, especially Keystone deployments or applications with remote request paths that influence pagination or query limits. Current exposure depends on deployed dependency versions and vendor package backports. Treat as a high-priority legacy dependency risk if affected versions remain deployed. The business concern is database compromise through application query handling, but urgency depends on whether legacy SQLAlchemy or Keystone components are still present. Mitigation focus: Inventory SQLAlchemy versions across applications, virtual environments, containers, and distro packages.; Upgrade SQLAlchemy to 0.7.0b4 or a vendor-fixed package where applicable.; Review Keystone deployments against Debian, Red Hat, Mandriva, and project advisories..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.