CVE-2024-53908: Django CVE-2024-53907 and CVE-2024-53908
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.haskey lookup via are unaffected.)
Other sources
Direct usage of the django.db.models.fields.json.HasKey lookup on Oracle is subject to SQL injection if untrusted data is used as a lhs value. Applications that use the lookup through the syntax are unaffected.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53908?
CVE-2024-53908 is classified as a critical vulnerability due to its potential for SQL injection.
How do I fix CVE-2024-53908?
To fix CVE-2024-53908, upgrade to Django versions 5.1.4, 5.0.10, or 4.2.17.
Which versions of Django are affected by CVE-2024-53908?
CVE-2024-53908 affects Django versions 5.1.0 to 5.1.3, 5.0.0 to 5.0.9, and 4.2.0 to 4.2.16.
What database is involved in the vulnerability CVE-2024-53908?
CVE-2024-53908 specifically involves the Oracle database when using the django.db.models.fields.json.HasKey lookup.
What can happen if CVE-2024-53908 is exploited?
Exploitation of CVE-2024-53908 could allow an attacker to perform SQL injection attacks, leading to unauthorized data access.