CVE-2024-53908: Django CVE-2024-53907 and CVE-2024-53908
First published: Thu Nov 28 2024(Updated: )
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/Django | >=4.2.0<4.2.17 | 4.2.17 |
| pip/Django | >=5.1.0<5.1.4 | 5.1.4 |
| pip/Django | >=5.0.0<5.0.10 | 5.0.10 |
| debian/python-django | <=3:3.2.19-1+deb12u1<=3:4.2.16-1 | 2:2.2.28-1~deb11u2 3:4.2.17-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/g/django-announce
- https://www.openwall.com/lists/oss-security/2024/12/04/3
- https://nvd.nist.gov/vuln/detail/CVE-2024-53908
- https://docs.djangoproject.com/en/dev/releases/security
- https://www.djangoproject.com/weblog/2024/dec/04/security-releases
- https://github.com/advisories/GHSA-m9g8-fxxm-xg86 (Advisory)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53908
- https://launchpad.net/bugs/cve/CVE-2024-53908
- https://security-tracker.debian.org/tracker/CVE-2024-53908
- https://ubuntu.com/security/CVE-2024-53908
- https://www.djangoproject.com/weblog/2024/dec/04/security-releases/
- https://github.com/django/django/commit/7376bcbf508883282ffcc0f0fac5cf0ed2d6cbc5
- https://access.redhat.com/errata/RHSA-2024:11144
- https://access.redhat.com/errata/RHSA-2024:11146
- https://bugzilla.redhat.com/show_bug.cgi?id=2329287
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-53907
- alias/CVE-2024-53908
- agent/title
- agent/type
- collector/nvd-api
- source/NVD
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-m9g8-fxxm-xg86
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/nvd-cve
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- collector/security-tracker-debian
- source/Debian
- agent/weakness
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- agent/severity
- agent/references
- agent/event
- agent/description
- agent/first-publish-date
- collector/github-advisory
- agent/tags
- agent/trending
- package-manager/pip
- package-manager/debian