Vulnerability advisory

GHSA-6r97-cj55-9hrq

SQL Injection in Django

Published Aug 16, 2019Updated Feb 21, 2025OSV record ↗

Also known as CVE-2019-14234PYSEC-2019-13

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected versions

django PyPI

All django advisories →

Affected	Fixed in
`1.11a1` to before 1.11.23	`1.11.23`Advisories →
Also listed as affected (25) `1.11` `1.11.1` `1.11.10` `1.11.11` `1.11.12` `1.11.13` `1.11.14` `1.11.15` `1.11.16` `1.11.17` `1.11.18` `1.11.2` `1.11.20` `1.11.21` `1.11.22` `1.11.3` `1.11.4` `1.11.5` `1.11.6` `1.11.7` `1.11.8` `1.11.9` `1.11a1` `1.11b1` `1.11rc1`
`2.1a1` to before 2.1.11	`2.1.11`Advisories →
Also listed as affected (13) `2.1` `2.1.1` `2.1.10` `2.1.2` `2.1.3` `2.1.4` `2.1.5` `2.1.7` `2.1.8` `2.1.9` `2.1a1` `2.1b1` `2.1rc1`
`2.2a1` to before 2.2.4	`2.2.4`Advisories →
Also listed as affected (7) `2.2` `2.2.1` `2.2.2` `2.2.3` `2.2a1` `2.2b1` `2.2rc1`

Description

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.

GHSA-6r97-cj55-9hrq

Affected versions

django PyPI

Description

References