CVE-2021-35042: SQL Injection
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.orderby SQL injection if orderby is untrusted input from a client of a web application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 3.1.13 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 3.2.5 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 3.1.13-r0
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-35042.
What is the severity of CVE-2021-35042?
The severity of CVE-2021-35042 is critical with a CVSS score of 9.8.
Which versions of Django are affected by CVE-2021-35042?
Django versions 3.1.x before 3.1.13 and 3.2.x before 3.2.5 are affected by CVE-2021-35042.
What is the impact of CVE-2021-35042?
CVE-2021-35042 allows SQL injection if untrusted input is used in the order_by parameter of QuerySet.order_by in a web application.
How can I fix CVE-2021-35042?
To fix CVE-2021-35042, upgrade Django to version 3.1.13 or 3.2.5, depending on the installed version.