Fluid Attacks Database

Description

Django SQL injection vulnerability An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	python-django	>=0 <3:4.2.15-1	3:4.2.15-1
pypi	django	>=5.0 <5.0.8 \|\| >=4.2 <4.2.15	5.0.8, 4.2.15
debian 11	python-django	=2:2.2.24-1 \|\| =2:2.2.25-1~deb11u1 \|\| =2:2.2.26-1~deb11u1 \|\| =2:2.2.28-1~deb11u1 \|\| =2:2.2.28-1~deb11u10 \|\| =2:2.2.28-1~deb11u2 \|\| =2:2.2.28-1~deb11u3 \|\| =2:2.2.28-1~deb11u4 \|\| =2:2.2.28-1~deb11u5 \|\| =2:2.2.28-1~deb11u6 \|\| =2:2.2.28-1~deb11u7 \|\| =2:2.2.28-1~deb11u8 \|\| =2:2.2.28-1~deb11u9 \|\| >=0 <2:2.2.28-1~deb11u11	2:2.2.28-1~deb11u11
debian 12	python-django	=3:3.2.19-1 \|\| =3:3.2.19-1+deb12u1 \|\| =3:3.2.19-1+deb12u1~bpo11+1 \|\| =3:3.2.19-1+deb12u2 \|\| =3:3.2.20-1 \|\| =3:3.2.20-1.1 \|\| =3:3.2.21-1 \|\| >=0 <3:3.2.25-0+deb12u1	3:3.2.25-0+deb12u1
debian 13	python-django	>=0 <3:4.2.15-1	3:4.2.15-1

Aliases

1. CVE-2024-420052. NVD-2024-420053. OSV-DEBIAN-2024-420054. OSV-2024-420055. GCVE-2024-420056. SECURITY-TRACKER-CVE-2024-42005

References

1. https://github.com/django/django/commit/32ebcbf2e1fe3e5ba79a6554a167efce81f7422d2. https://github.com/django/django/commit/f4af67b9b41e0f4c117a8741da3abbd1c869ab283. https://docs.djangoproject.com/en/dev/releases/security4. https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-70.yaml5. https://groups.google.com/forum/#%21forum/django-announce6. https://security.netapp.com/advisory/ntap-20240905-00077. https://www.djangoproject.com/weblog/2024/aug/06/security-releases

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.