CVE-2024-53908

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-53908

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-53908.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-53908

Aliases

Related

Published

2024-12-06T12:15:18Z

Modified

2025-01-14T12:17:30.664343Z

Summary

[none]

Details

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.haskey lookup via _ are unaffected.)

References

Affected packages

Debian:12 / python-django

Package

Name: python-django
Purl: pkg:deb/debian/python-django?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3:3.*

3:3.2.19-1

3:3.2.19-1+deb12u1~bpo11+1

3:3.2.19-1+deb12u1

3:3.2.19-1+deb12u2

3:3.2.20-1

3:3.2.20-1.1

3:3.2.21-1

3:4.*

3:4.1-1

3:4.1.1-1

3:4.1.2-1

3:4.1.3-1

3:4.1.4-1

3:4.1.5-1

3:4.2~alpha1-1

3:4.2~beta1-1

3:4.2~rc1-1

3:4.2-1

3:4.2.1-1

3:4.2.2-1

3:4.2.3-1

3:4.2.4-1

3:4.2.5-1

3:4.2.5-2

3:4.2.6-1

3:4.2.8-1

3:4.2.9-1

3:4.2.10-1

3:4.2.11-1

3:4.2.13-1

3:4.2.14-1

3:4.2.15-1~bpo12+1

3:4.2.15-1

3:4.2.16-1

3:4.2.17-1

3:4.2.17-2

3:5.*

3:5.0~alpha1-1

3:5.0~rc1-1

3:5.0-1

3:5.0.1-1

3:5.0.2-1

3:5.0.3-1

3:5.0.4-1

3:5.0.6-1

3:5.1~alpha1-1

3:5.1~beta1-1

3:5.1~rc1-1

3:5.1-1

3:5.1.1-1

3:5.1.2-1

3:5.1.3-1

3:5.1.4-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / python-django