diff options
| author | Jacob Walls <jacobtylerwalls@gmail.com> | 2025-11-17 17:09:54 -0500 |
|---|---|---|
| committer | Natalia <124304+nessita@users.noreply.github.com> | 2025-12-02 09:27:34 -0300 |
| commit | 479415ce5249bcdebeb6570c72df2a87f45a7bbf (patch) | |
| tree | d7959f5126003e1bd994831b8e40288c899db54f /docs/releases/4.2.27.txt | |
| parent | da1dfe64c821ba03ca7b0c936184cca1ad641316 (diff) | |
[5.2.x] Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL injection in column aliases on PostgreSQL.
Follow-up to CVE-2025-57833.
Thanks Stackered for the report, and Simon Charette and Mariusz Felisiak
for the reviews.
Backport of 5b90ca1e7591fa36fccf2d6dad67cf1477e6293e from main.
Diffstat (limited to 'docs/releases/4.2.27.txt')
| -rw-r--r-- | docs/releases/4.2.27.txt | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/docs/releases/4.2.27.txt b/docs/releases/4.2.27.txt index 7ffa5fa458..e95dc63f74 100644 --- a/docs/releases/4.2.27.txt +++ b/docs/releases/4.2.27.txt @@ -7,6 +7,14 @@ Django 4.2.27 release notes Django 4.2.27 fixes one security issue with severity "high", one security issue with severity "moderate", and one bug in 4.2.26. +CVE-2025-13372: Potential SQL injection in ``FilteredRelation`` column aliases on PostgreSQL +============================================================================================ + +:class:`.FilteredRelation` was subject to SQL injection in column aliases, +using a suitably crafted dictionary, with dictionary expansion, as the +``**kwargs`` passed to :meth:`.QuerySet.annotate` or :meth:`.QuerySet.alias` on +PostgreSQL. + Bugfixes ======== |