Wind River Support Network

HomeDefectsLIN1023-7612
Fixed

LIN1023-7612 : Security Advisory - python-django - CVE-2024-42005

Created: Aug 6, 2024    Updated: Sep 15, 2024
Resolved Date: Sep 9, 2024
Found In Version: 10.23.30.1
Fix Version: 10.23.30.13
Severity: Standard
Applicable for: Wind River Linux LTS 23
Component/s: Userspace

Description

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

https://nvd.nist.gov/vuln/detail/CVE-2024-42005

CVEs


Live chat
Online