CVE-2024-53908
2 advisories.
PyPI/django CVE-2024-53908: critical 9.8
Django SQL injection in HasKey(lhs, rhs) on Oracle
Action: Upgrade django to 4.2.17 or later.
pip install django==5.0.10pip install django==5.1.4pip install django==4.2.17Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.0.0 | 5.0.10 | - |
| 5.1.0 | 5.1.4 | - |
| 4.2.0 | 4.2.17 | - |
| 5.1 | 5.1.4 | - |
| 5.0 | 5.0.10 | - |
| 4.2 | 4.2.17 | - |
Fixed versions
| 5.0.10 | 5.1.4 | 4.2.17 |
Sources
- osv: GHSA-m9g8-fxxm-xg86
- https://nvd.nist.gov/vuln/detail/CVE-2024-53908
- https://docs.djangoproject.com/en/dev/releases/security
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-157.yaml
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2024/dec/04/security-releases
- https://www.openwall.com/lists/oss-security/2024/12/04/3
CVE-2024-53908 · published · modified · JSON
PyPI/django CVE-2024-53908: critical 9.8
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subjec
Action: Upgrade django to 4.2.17 or later.
pip install django==5.1.4pip install django==5.0.10pip install django==4.2.17Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.2 | 4.2.17 | - |
| 5.0 | 5.0.10 | - |
| 5.1 | 5.1.4 | - |
Fixed versions
| 5.1.4 | 5.0.10 | 4.2.17 |
Sources
- osv: PYSEC-2024-157
- nvd: CVE-2024-53908
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/g/django-announce
- https://www.openwall.com/lists/oss-security/2024/12/04/3
- https://github.com/advisories/GHSA-m9g8-fxxm-xg86
CVE-2024-53908 · published · modified · JSON