CVE-2024-42005: Django CVE-2024-41989, CVE-2024-41990, CVE-2024-41991, and CVE-2024-42005
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and valueslist() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed arg.
Other sources
Description: QuerySet.values() and QuerySet.valueslist() methods on models with a JSONField were subject to SQL injection in column aliases, via a crafted JSON object key as a passed arg.
Affected versions =================
Django main development branch Django 5.1 (currently at release candidate status) Django 5.0 Django 4.2
— Red Hat
Django is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements to the QuerySet.values() and valueslist() method, which could allow the attacker to view, add, modify or delete information in the back-end database.
— IBM
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42005?
CVE-2024-42005 has been rated as a high severity vulnerability due to its potential for SQL injection.
How do I fix CVE-2024-42005?
To fix CVE-2024-42005, upgrade Django to version 4.2.15 or 5.0.8 or later.
What software is affected by CVE-2024-42005?
CVE-2024-42005 affects Django versions 5.0 through 5.0.7 and 4.2 through 4.2.14.
What methods in Django are vulnerable in CVE-2024-42005?
The QuerySet.values() and values_list() methods are vulnerable in CVE-2024-42005.
Is CVE-2024-42005 an issue with JSONField in Django?
Yes, CVE-2024-42005 specifically involves SQL injection vulnerabilities in JSONField column aliases.