PYSEC-2021-109

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2021-109.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2021-109

Aliases

BIT-django-2021-35042
CVE-2021-35042
GHSA-xpfp-f569-q3p2

Published

2021-07-02T10:15:00Z

Modified

2023-12-06T00:46:16.318032Z

Summary

[none]

Details

Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application.

References

https://docs.djangoproject.com/en/3.2/releases/security/
https://www.openwall.com/lists/oss-security/2021/07/02/2
https://groups.google.com/forum/#!forum/django-announce
https://www.djangoproject.com/weblog/2021/jul/01/security-releases/
https://github.com/advisories/GHSA-xpfp-f569-q3p2

Affected packages

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.1

Fixed

3.1.13

Introduced

3.2

Fixed

3.2.5

Affected versions

3.*

3.1

3.1.1

3.1.2

3.1.3

3.1.4

3.1.5

3.1.6

3.1.7

3.1.8

3.1.9

3.1.10

3.1.11

3.1.12

3.2

3.2.1

3.2.2

3.2.3

3.2.4