PyPI/django CVE-2019-14234: critical 9.8, EPSS 47.69%

SQL Injection in Django

Action: Upgrade django to 1.11.23 or later.

pip install django==1.11.23

pip install django==2.1.11

pip install django==2.2.4

Affected

Fixed versions

Sources

• osv: GHSA-6r97-cj55-9hrq
• https://nvd.nist.gov/vuln/detail/CVE-2019-14234
• https://github.com/django/django/commit/4f5b58f5cd3c57fee9972ab074f8dc6895d8f387
• https://github.com/django/django/commit/ed682a24fca774818542757651bfba576c3fc3ef
• https://github.com/django/django/commit/f74b3ae3628c26e1b4f8db3d13a91d52a833a975
• https://docs.djangoproject.com/en/dev/releases/security
• https://github.com/advisories/GHSA-6r97-cj55-9hrq
• https://github.com/django/django
• https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-13.yaml
• https://groups.google.com/forum/#!topic/django-announce/jIoju2-KLDs
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK
• https://seclists.org/bugtraq/2019/Aug/15
• https://security.gentoo.org/glsa/202004-17
• https://security.netapp.com/advisory/ntap-20190828-0002
• https://www.debian.org/security/2019/dsa-4498
• https://www.djangoproject.com/weblog/2019/aug/01/security-releases
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html

CVE-2019-14234 · published 2019-08-16T14:00:34Z · modified 2025-02-21T05:50:19.980781Z · JSON