CVE-2024-42005: Django CVE-2024-41989, CVE-2024-41990, CVE-2024-41991, and CVE-2024-42005
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and valueslist() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed arg.
Other sources
Description: QuerySet.values() and QuerySet.valueslist() methods on models with a JSONField were subject to SQL injection in column aliases, via a crafted JSON object key as a passed arg.
Affected versions =================
Django main development branch Django 5.1 (currently at release candidate status) Django 5.0 Django 4.2
— Red Hat
Django is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements to the QuerySet.values() and valueslist() method, which could allow the attacker to view, add, modify or delete information in the back-end database.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.2.15 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 5.0.8 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.25-0+deb12u1 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:4.2.15-1 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 4.2.16-r0 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.25-0+deb12u3Fixed in 3:3.2.25-0+deb12u6Fixed in 3:4.2.28-0+deb13u2Fixed in 3:4.2.28-0+deb13u1Fixed in 3:5.2.17-2Fixed in 3:5.2.19-1 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.0.8 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 4.2.15
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42005?
CVE-2024-42005 has been rated as a high severity vulnerability due to its potential for SQL injection.
How do I fix CVE-2024-42005?
To fix CVE-2024-42005, upgrade Django to version 4.2.15 or 5.0.8 or later.
What software is affected by CVE-2024-42005?
CVE-2024-42005 affects Django versions 5.0 through 5.0.7 and 4.2 through 4.2.14.
What methods in Django are vulnerable in CVE-2024-42005?
The QuerySet.values() and values_list() methods are vulnerable in CVE-2024-42005.
Is CVE-2024-42005 an issue with JSONField in Django?
Yes, CVE-2024-42005 specifically involves SQL injection vulnerabilities in JSONField column aliases.