REDHAT-BUG-2302436: SQL Injection
Description: QuerySet.values() and QuerySet.valueslist() methods on models with a JSONField were subject to SQL injection in column aliases, via a crafted JSON object key as a passed arg.
Affected versions =================
Django main development branch Django 5.1 (currently at release candidate status) Django 5.0 Django 4.2
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2302436?
The severity of REDHAT-BUG-2302436 is considered high due to its potential for SQL injection vulnerabilities.
How do I fix REDHAT-BUG-2302436?
To fix REDHAT-BUG-2302436, update your Django version to a patched release above 5.1.
Which versions of Django are affected by REDHAT-BUG-2302436?
Django main development branch and all versions from 4.2 up to 5.1 are affected by REDHAT-BUG-2302436.
What are the symptoms of REDHAT-BUG-2302436?
The symptoms of REDHAT-BUG-2302436 include possible unexpected SQL execution or data leaks when using QuerySet.values() and values_list() with a JSONField.
Is REDHAT-BUG-2302436 a common vulnerability?
Yes, REDHAT-BUG-2302436 represents a common vulnerability that arises from the misuse of dynamic SQL in web applications.