diff options
| author | Simon Charette <charette.s@gmail.com> | 2024-11-08 21:27:31 -0500 |
|---|---|---|
| committer | Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> | 2024-12-04 14:32:17 +0100 |
| commit | 7376bcbf508883282ffcc0f0fac5cf0ed2d6cbc5 (patch) | |
| tree | d1a37f839bd94179b3e357a0bbc356051fe74397 /docs | |
| parent | 790eb058b0716c536a2f2e8d1c6d5079d776c22b (diff) | |
[4.2.x] Fixed CVE-2024-53908 -- Prevented SQL injections in direct HasKeyLookup usage on Oracle.
Thanks Seokchan Yoon for the report, and Mariusz Felisiak and Sarah
Boyce for the reviews.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/4.2.17.txt | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/docs/releases/4.2.17.txt b/docs/releases/4.2.17.txt index 9db07f6da7..9a6aee3db6 100644 --- a/docs/releases/4.2.17.txt +++ b/docs/releases/4.2.17.txt @@ -22,3 +22,12 @@ Remember that absolutely NO guarantee is provided about the results of ``strip_tags()`` being HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without escaping it first, for example with :func:`django.utils.html.escape`. + +CVE-2024-53908: Potential SQL injection via ``HasKey(lhs, rhs)`` on Oracle +========================================================================== + +Direct usage of the ``django.db.models.fields.json.HasKey`` lookup on Oracle +was subject to SQL injection if untrusted data was used as a ``lhs`` value. + +Applications that use the :lookup:`has_key <jsonfield.has_key>` lookup through +the ``__`` syntax are unaffected. |