diff options
| author | Simon Charette <charette.s@gmail.com> | 2024-11-08 21:27:31 -0500 |
|---|---|---|
| committer | Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> | 2024-12-04 14:25:15 +0100 |
| commit | ff08bb6c70aa45f83a5ef3bd0b601c7c9d1a7642 (patch) | |
| tree | 022f5daa4f5d2be2bebef5e0c427b1742535ad0d /docs | |
| parent | a5a89ea28cc550c1b29b03f9e14ef3c128ec1e84 (diff) | |
[5.0.x] Fixed CVE-2024-53908 -- Prevented SQL injections in direct HasKeyLookup usage on Oracle.
Thanks Seokchan Yoon for the report, and Mariusz Felisiak and Sarah
Boyce for the reviews.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/4.2.17.txt | 9 | ||||
| -rw-r--r-- | docs/releases/5.0.10.txt | 9 |
2 files changed, 18 insertions, 0 deletions
diff --git a/docs/releases/4.2.17.txt b/docs/releases/4.2.17.txt index 9db07f6da7..9a6aee3db6 100644 --- a/docs/releases/4.2.17.txt +++ b/docs/releases/4.2.17.txt @@ -22,3 +22,12 @@ Remember that absolutely NO guarantee is provided about the results of ``strip_tags()`` being HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without escaping it first, for example with :func:`django.utils.html.escape`. + +CVE-2024-53908: Potential SQL injection via ``HasKey(lhs, rhs)`` on Oracle +========================================================================== + +Direct usage of the ``django.db.models.fields.json.HasKey`` lookup on Oracle +was subject to SQL injection if untrusted data was used as a ``lhs`` value. + +Applications that use the :lookup:`has_key <jsonfield.has_key>` lookup through +the ``__`` syntax are unaffected. diff --git a/docs/releases/5.0.10.txt b/docs/releases/5.0.10.txt index 54569516a5..ae1fbf99e4 100644 --- a/docs/releases/5.0.10.txt +++ b/docs/releases/5.0.10.txt @@ -22,3 +22,12 @@ Remember that absolutely NO guarantee is provided about the results of ``strip_tags()`` being HTML safe. So NEVER mark safe the result of a ``strip_tags()`` call without escaping it first, for example with :func:`django.utils.html.escape`. + +CVE-2024-53908: Potential SQL injection via ``HasKey(lhs, rhs)`` on Oracle +========================================================================== + +Direct usage of the ``django.db.models.fields.json.HasKey`` lookup on Oracle +was subject to SQL injection if untrusted data was used as a ``lhs`` value. + +Applications that use the :lookup:`has_key <jsonfield.has_key>` lookup through +the ``__`` syntax are unaffected. |