CVE-2021-35042

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application.

Database specific

{
    "unresolved_ranges": [
        {
            "vendor_product": "fedoraproject:fedora",
            "cpes": [
                "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "last_affected": "34"
                }
            ],
            "source": "CPE_STRING"
        }
    ]
}

References

Affected packages

Git / github.com/django/django

Affected ranges

Type

GIT

Repo

https://github.com/django/django

Events

Introduced

0b8a0296bfd30748f08021834e95cdae241686e8

Fixed

43873b9c92cfe68a082c7feda86f6fb95a3e902c

Introduced

3591e1c1acbd7c13174275367c3fdf012cb0413b

Fixed

0eca7a66239ef646f59fe2af643199275dae7a35

Database specific

{
    "cpe": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.1"
        },
        {
            "fixed": "3.1.13"
        },
        {
            "introduced": "3.2"
        },
        {
            "fixed": "3.2.5"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-35042.json"