CVE-2024-53908

CVE Details

Release Date:	2024-12-06
Impact:	Low	What is this?

Description

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)

See more information about CVE-2024-53908 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	9.8
Vector String:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Version:	3.1
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	High
Integrity Impact:	High
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (ol-automation-manager)	OLAMSA-2025-0002	2025-02-14
Oracle Linux version 8 (ol-automation-manager)	OLAMSA-2025-0007	2025-06-09
Oracle Linux version 8 (python-django)	OLAMSA-2025-0002	2025-02-14
Oracle Linux version 8 (python-jinja2)	OLAMSA-2025-0002	2025-02-14
Oracle Linux version 8 (python-jinja2)	OLAMSA-2025-0007	2025-06-09
Oracle Linux version 8 (python-pulpcore)	OLAMSA-2025-0007	2025-06-09
Oracle Linux version 8 (python3.11-cryptography)	OLAMSA-2025-0002	2025-02-14