diff options
| author | Simon Charette <charette.s@gmail.com> | 2024-07-25 18:19:13 +0200 |
|---|---|---|
| committer | Sarah Boyce <42296566+sarahboyce@users.noreply.github.com> | 2024-08-06 08:51:55 +0200 |
| commit | 32ebcbf2e1fe3e5ba79a6554a167efce81f7422d (patch) | |
| tree | ece61f70ea6a6c10ff44655f0dcb924a806bb628 /docs/releases | |
| parent | 523da8771bce321023f490f70d71a9e973ddc927 (diff) | |
[5.0.x] Fixed CVE-2024-42005 -- Mitigated QuerySet.values() SQL injection attacks against JSON fields.
Thanks Eyal (eyalgabay) for the report.
Diffstat (limited to 'docs/releases')
| -rw-r--r-- | docs/releases/4.2.15.txt | 7 | ||||
| -rw-r--r-- | docs/releases/5.0.8.txt | 7 |
2 files changed, 14 insertions, 0 deletions
diff --git a/docs/releases/4.2.15.txt b/docs/releases/4.2.15.txt index 1c6a1c7ede..b1d4684596 100644 --- a/docs/releases/4.2.15.txt +++ b/docs/releases/4.2.15.txt @@ -30,6 +30,13 @@ CVE-2024-41991: Potential denial-of-service vulnerability in ``django.utils.html subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. +CVE-2024-42005: Potential SQL injection in ``QuerySet.values()`` and ``values_list()`` +====================================================================================== + +:meth:`.QuerySet.values` and :meth:`~.QuerySet.values_list` methods on models +with a ``JSONField`` were subject to SQL injection in column aliases, via a +crafted JSON object key as a passed ``*arg``. + Bugfixes ======== diff --git a/docs/releases/5.0.8.txt b/docs/releases/5.0.8.txt index 2a0823d0ca..37f51f71c7 100644 --- a/docs/releases/5.0.8.txt +++ b/docs/releases/5.0.8.txt @@ -30,6 +30,13 @@ CVE-2024-41991: Potential denial-of-service vulnerability in ``django.utils.html subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters. +CVE-2024-42005: Potential SQL injection in ``QuerySet.values()`` and ``values_list()`` +====================================================================================== + +:meth:`.QuerySet.values` and :meth:`~.QuerySet.values_list` methods on models +with a ``JSONField`` were subject to SQL injection in column aliases, via a +crafted JSON object key as a passed ``*arg``. + Bugfixes ======== |