CVE-2021-35042

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application.

References

Affected packages

Git / github.com/django/django

Affected ranges

Type

GIT

Repo

https://github.com/django/django

Events

Introduced

0b8a0296bfd30748f08021834e95cdae241686e8

Fixed

43873b9c92cfe68a082c7feda86f6fb95a3e902c

Introduced

3591e1c1acbd7c13174275367c3fdf012cb0413b

Fixed

0eca7a66239ef646f59fe2af643199275dae7a35

Database specific

{
    "versions": [
        {
            "introduced": "3.1"
        },
        {
            "fixed": "3.1.13"
        },
        {
            "introduced": "3.2"
        },
        {
            "fixed": "3.2.5"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-35042.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "34"
            }
        ]
    }
]