CVE-2019-14234
Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 47.7%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 47.69% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- djangoproject/django · fedoraproject/fedora · debian/debian linux
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlMailing List, Third Party Advisory
- https://docs.djangoproject.com/en/dev/releases/security/Vendor Advisory
- https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/
- https://seclists.org/bugtraq/2019/Aug/15Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202004-17
- https://security.netapp.com/advisory/ntap-20190828-0002/
- https://www.debian.org/security/2019/dsa-4498Third Party Advisory
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases/Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlMailing List, Third Party Advisory
- https://docs.djangoproject.com/en/dev/releases/security/Vendor Advisory
- https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/
- https://seclists.org/bugtraq/2019/Aug/15Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202004-17
- https://security.netapp.com/advisory/ntap-20190828-0002/
- https://www.debian.org/security/2019/dsa-4498Third Party Advisory
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.