{"action":"Upgrade django to 3.1.13 or later.","affected":[{"fixed":"3.1.13","introduced":"3.1"},{"fixed":"3.2.5","introduced":"3.2"}],"component":"django","cve_ids":["CVE-2021-35042"],"ecosystem":"PyPI","epss":0.44369,"exploited":false,"fixed_versions":["3.1.13","3.2.5"],"ghsa_id":"GHSA-xpfp-f569-q3p2","id":"tcs_01M5KGB2NFWJWDHH9EJCC0JPPF","modified_at":"2023-12-06T01:01:17.903404Z","published_at":"2021-07-02T10:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-109","https://docs.djangoproject.com/en/3.2/releases/security/","https://www.openwall.com/lists/oss-security/2021/07/02/2","https://groups.google.com/forum/#!forum/django-announce","https://www.djangoproject.com/weblog/2021/jul/01/security-releases/","https://github.com/advisories/GHSA-xpfp-f569-q3p2"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-109","url":"https://osv.dev/vulnerability/PYSEC-2021-109"}],"summary":"Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application."}