{"id":"CVE-2019-14234","aliases":["ALPINE-CVE-2019-14234","DEBIAN-CVE-2019-14234","DSA-4498-1","EUVD-2019-0037","GHSA-6r97-cj55-9hrq","PYSEC-2019-13","RHSA-2020:1324","RHSA-2020:4390","SUSE-SU-2019:2180-1","SUSE-SU-2019:2257-1","SUSE-SU-2019:2335-1","UBUNTU-CVE-2019-14234","USN-4084-1","openSUSE-SU-2019:1839-1","openSUSE-SU-2019:1872-1"],"status":"published","title":"SQL Injection in Django","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.47694,"percentile":0.98859,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-89"],"published":"2019-08-01T10:00:00Z","modified":"2026-11-03T06:31:50Z","exploits":[{"source":"pocgithub","id":"malvika-thakur/CVE-2019-14234","title":"malvika-thakur/CVE-2019-14234","date":"2023-09-15","url":"https://github.com/malvika-thakur/CVE-2019-14234"}],"fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["1.11.23","2.1.11","2.2.4"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.10","package":"py-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"py-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"py-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"py-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-django","fixed_in":["1.11.23-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-django","fixed_in":["2:2.2.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["2:2.2.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["2:2.2.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"python-django","fixed_in":["1.8.7-1ubuntu5.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"python-django","fixed_in":["1:1.11.11-1ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"python-django","fixed_in":["1:1.11.22-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11a1"},{"fixed":"1.11.23"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1a1"},{"fixed":"2.1.11"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2a1"},{"fixed":"2.2.4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"py-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.4-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.10.7-2+deb9u6"}]}],"versions":["1:1.10.7-2","1:1.10.7-2+deb9u1","1:1.10.7-2+deb9u2","1:1.10.7-2+deb9u3","1:1.10.7-2+deb9u4","1:1.10.7-2+deb9u5"],"bundled":4},{"source":"osv","ecosystem":"Debian:10","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.23-1~deb10u1"}]}],"versions":["1:1.11.21-1","1:1.11.22-1","1:1.11.22-1~deb10u1"],"bundled":4},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11a1"},{"fixed":"1.11.23"}]}],"versions":["1.11","1.11.1","1.11.10","1.11.11","1.11.12","1.11.13","1.11.14","1.11.15","1.11.16","1.11.17","1.11.18","1.11.2","1.11.20","1.11.21","1.11.22","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9","1.11a1","1.11b1","1.11rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1a1"},{"fixed":"2.1.11"}]}],"versions":["2.1","2.1.1","2.1.10","2.1.2","2.1.3","2.1.4","2.1.5","2.1.7","2.1.8","2.1.9","2.1a1","2.1b1","2.1rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2a1"},{"fixed":"2.2.4"}]}],"versions":["2.2","2.2.1","2.2.2","2.2.3","2.2a1","2.2b1","2.2rc1"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1"},{"fixed":"2.1.11"},{"introduced":"1.11"},{"fixed":"1.11.23"},{"introduced":"2.2"},{"fixed":"2.2.4"}]}],"versions":["1.11","1.11.1","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9","1.11.10","1.11.11","1.11.12","1.11.13","1.11.14","1.11.15","1.11.16","1.11.17","1.11.18","1.11.20","1.11.21","1.11.22","2.1","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.1.7","2.1.8","2.1.9","2.1.10","2.2","2.2.1","2.2.2","2.2.3"]},{"source":"osv","ecosystem":"Red Hat:openstack:15::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.11-1.el8ost"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:15::el8","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.11-1.el8ost"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:15::el8","package":"python3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.11-1.el8ost"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:13::el7","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.27-1.el7ost"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:13::el7","package":"python-django-bash-completion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.27-1.el7ost"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:13::el7","package":"python2-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.27-1.el7ost"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.19-3.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.12.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Django1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Django1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.23-3.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.4-1ubuntu1","1.6-1","1.6.1-1","1.6.1-2","1.6.1-2ubuntu0.1","1.6.1-2ubuntu0.2","1.6.1-2ubuntu0.3","1.6.1-2ubuntu0.4","1.6.1-2ubuntu0.5","1.6.1-2ubuntu0.6","1.6.1-2ubuntu0.8","1.6.1-2ubuntu0.9","1.6.1-2ubuntu0.10","1.6.1-2ubuntu0.11","1.6.1-2ubuntu0.12","1.6.1-2ubuntu0.13","1.6.1-2ubuntu0.14","1.6.1-2ubuntu0.15","1.6.1-2ubuntu0.16","1.6.11-0ubuntu1","1.6.11-0ubuntu1.1","1.6.11-0ubuntu1.2","1.6.11-0ubuntu1.3","1.6.11-0ubuntu1.3+esm1","1.6.11-0ubuntu1.3+esm2","1.6.11-0ubuntu1.3+esm3","1.6.11-0ubuntu1.3+esm4","1.6.11-0ubuntu1.3+esm5","1.6.11-0ubuntu1.3+esm6","1.6.11-0ubuntu1.3+esm7","1.6.11-0ubuntu1.3+esm8","1.6.11-0ubuntu1.3+esm9","1.6.11-0ubuntu1.3+esm10","1.6.11-0ubuntu1.3+esm11","1.6.11-0ubuntu1.3+esm12"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.10"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8","1.8.7-1ubuntu5.9"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.5"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.22-1ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1ubuntu5.10"}]}],"versions":["1.7.9-1ubuntu5","1.8.5-2ubuntu1","1.8.7-1ubuntu1","1.8.7-1ubuntu2","1.8.7-1ubuntu3","1.8.7-1ubuntu4","1.8.7-1ubuntu5","1.8.7-1ubuntu5.1","1.8.7-1ubuntu5.2","1.8.7-1ubuntu5.4","1.8.7-1ubuntu5.5","1.8.7-1ubuntu5.6","1.8.7-1ubuntu5.7","1.8.7-1ubuntu5.8","1.8.7-1ubuntu5.9"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.11.11-1ubuntu1.5"}]}],"versions":["1:1.11.4-1ubuntu1","1:1.11.6-1ubuntu1","1:1.11.9-1ubuntu1","1:1.11.11-1ubuntu1","1:1.11.11-1ubuntu1.1","1:1.11.11-1ubuntu1.2","1:1.11.11-1ubuntu1.3","1:1.11.11-1ubuntu1.4"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-lp151.2.3.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.4-bp151.3.3.1"}]}],"bundled":7}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"djangoproject","product":"django"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.djangoproject.com/weblog/2019/aug/01/security-releases/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","article"]},{"url":"https://seclists.org/bugtraq/2019/Aug/15","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2019/dsa-4498","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190828-0002/","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/202004-17","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14234","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/django-announce/jIoju2-KLDs","tags":["web"]},{"url":"https://github.com/django/django/commit/4f5b58f5cd3c57fee9972ab074f8dc6895d8f387","tags":["web"]},{"url":"https://github.com/django/django/commit/ed682a24fca774818542757651bfba576c3fc3ef","tags":["web"]},{"url":"https://github.com/django/django/commit/f74b3ae3628c26e1b4f8db3d13a91d52a833a975","tags":["web"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6r97-cj55-9hrq","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-13.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20190828-0002","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2019/aug/01/security-releases","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-14234","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-14234","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1324","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1724497","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734417","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734422","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1324.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-12781","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12781","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12781","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2019/jul/01/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14232","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14232","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14232","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14233","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14233","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14233","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14234","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14234","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14235","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14235","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14235","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4390","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4390.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192180-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1142880","tags":["report"]},{"url":"https://bugzilla.suse.com/1142882","tags":["report"]},{"url":"https://bugzilla.suse.com/1142883","tags":["report"]},{"url":"https://bugzilla.suse.com/1142885","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14235","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192257-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1136468","tags":["report"]},{"url":"https://bugzilla.suse.com/1139945","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12781","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192335-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-14234","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4084-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-14232","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14235","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3LGJSPCN3VEG2UJPYCUB6TU75JTIV2TQ/#3LGJSPCN3VEG2UJPYCUB6TU75JTIV2TQ","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11358","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5XTP44JEOSNXRVW4JDZXA5XGMBDZLWSW/#5XTP44JEOSNXRVW4JDZXA5XGMBDZLWSW","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-14234","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.","status":"published","published":"2019-08-09T12:16:44Z","modified":"2024-08-05T00:12:42.48Z","updated_at":"2026-11-02T14:20:18.085548Z"}],"euvd":[{"id":"EUVD-2019-0037","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.","status":"published","published":"2019-08-09T12:16:44Z","modified":"2024-08-05T00:12:42Z","updated_at":"2026-11-03T02:40:40.581814Z"}],"ghsa":[{"id":"GHSA-6r97-cj55-9hrq","title":"SQL Injection in Django","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.","status":"published","published":"2019-08-16T14:00:34Z","modified":"2024-09-20T16:08:24Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2019-14234","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.","status":"published","published":"2019-08-09T13:15:11.777Z","modified":"2026-06-17T02:18:00.427Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:05:22.878504Z"}],"osv":[{"id":"ALPINE-CVE-2019-14234","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.","status":"published","published":"2019-08-09T13:15:11.777Z","modified":"2026-11-03T06:31:50.828894605Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2019-14234","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.","status":"published","published":"2019-08-09T13:15:11.777Z","modified":"2026-10-24T10:31:05.628414527Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-14234","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.","status":"published","published":"2019-08-09T13:15:11.777Z","modified":"2026-09-21T07:00:37.993369815Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"GHSA-6r97-cj55-9hrq","title":"SQL Injection in Django","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.","status":"published","published":"2019-08-16T14:00:34Z","modified":"2025-02-21T05:50:19.980781Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"RHSA-2020:1324","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-18T04:23:52Z","modified":"2026-06-28T10:35:46Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:4390","title":"Red Hat Security Advisory: python-django security update","status":"published","published":"2024-09-18T04:24:05Z","modified":"2026-06-28T10:40:12Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2019-14234","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.","status":"published","published":"2019-08-01T10:00:00Z","modified":"2026-10-01T14:01:34.811653662Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DSA-4498-1","title":"python-django - security update","status":"published","published":"2019-08-12T00:00:00Z","modified":"2026-03-09T02:10:45.140647Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"openSUSE-SU-2019:1839-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\nSecurity issues fixed:\n\t  \n- CVE-2019-11358: Fixed prototype pollution.\n- CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468)\n- CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).\n- CVE-2019-14232: Fixed denial-of-service possibility in ``django.utils.text.Truncator`` (bsc#1142880).\n- CVE-2019-14233: Fixed denial-of-service possibility in ``strip_tags()`` (bsc#1142882).\n- CVE-2019-14234: Fixed SQL injection possibility in key and index lookups for ``JSONField``/``HStoreField`` (bsc#1142883).\n- CVE-2019-14235: Fixed potential memory exhaustion in ``django.utils.encoding.uri_to_iri()`` (bsc#1142885).\n\nNon-security issues fixed:\n\n- Fixed a migration crash on PostgreSQL when adding a check constraint with a contains lookup on DateRangeField or DateTimeRangeField, if the right hand side of an expression is the same type.\n  ","status":"published","published":"2019-08-08T15:57:07Z","modified":"2026-02-04T02:34:28.956376Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:1872-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\nSecurity issues fixed:\n\t  \n- CVE-2019-11358: Fixed prototype pollution.\n- CVE-2019-12308: Fixed XSS in AdminURLFieldWidget (bsc#1136468)\n- CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).\n- CVE-2019-14232: Fixed denial-of-service possibility in ``django.utils.text.Truncator`` (bsc#1142880).\n- CVE-2019-14233: Fixed denial-of-service possibility in ``strip_tags()`` (bsc#1142882).\n- CVE-2019-14234: Fixed SQL injection possibility in key and index lookups for ``JSONField``/``HStoreField`` (bsc#1142883).\n- CVE-2019-14235: Fixed potential memory exhaustion in ``django.utils.encoding.uri_to_iri()`` (bsc#1142885).\n\nNon-security issues fixed:\n\n- Fixed a migration crash on PostgreSQL when adding a check constraint with a contains lookup on DateRangeField or DateTimeRangeField, if the right hand side of an expression is the same type.\n  \nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2019-08-14T09:13:06Z","modified":"2026-02-04T04:08:53.819357Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"PYSEC-2019-13","description":"An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.","status":"published","published":"2019-08-09T13:15:00Z","modified":"2023-11-08T04:01:09.403667Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"SUSE-SU-2019:2180-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\n- CVE-2019-14232: Fixed a denial of service in 'django.utils.text.Truncator' (bsc#1142880).\n- CVE-2019-14233: Fixed a denial of service in strip_tags() (bsc#1142882).\n- CVE-2019-14234: Fixed an SQL injection in key and index lookups for 'JSONField'/'HStoreField' (bsc#1142883).\n- CVE-2019-14235: Fixed a potential memory exhaustion in 'django.utils.encoding.uri_to_iri()' (bsc#1142885).\n","status":"published","published":"2019-08-19T14:48:36Z","modified":"2026-02-04T03:26:47.803093Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2257-1","title":"Security update for python-Django","description":"This update for python-Django to version 1.11.23 fixes the following issues:\n\n- CVE-2019-14232: Fixed a denial of service in 'django.utils.text.Truncator' (bsc#1142880).\n- CVE-2019-14233: Fixed a denial of service in strip_tags() (bsc#1142882).\n- CVE-2019-14234: Fixed an SQL injection in key and index lookups for 'JSONField'/'HStoreField' (bsc#1142883).\n- CVE-2019-14235: Fixed a potential memory exhaustion in 'django.utils.encoding.uri_to_iri()' (bsc#1142885).\n- CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).\n- CVE-2019-12308: Fixed a cross site scripting vulnerability in the AdminURLFieldWidget (bsc#1136468).\n","status":"published","published":"2019-09-02T07:03:33Z","modified":"2026-02-04T03:40:58.849461Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2335-1","title":"Security update for python-Django1","description":"This update for python-Django1 to version 1.11.23 fixes the following issues:\n\n- CVE-2019-14232: Fixed a denial of service in 'django.utils.text.Truncator' (bsc#1142880).\n- CVE-2019-14233: Fixed a denial of service in strip_tags() (bsc#1142882).\n- CVE-2019-14234: Fixed an SQL injection in key and index lookups for 'JSONField'/'HStoreField' (bsc#1142883).\n- CVE-2019-14235: Fixed a potential memory exhaustion in 'django.utils.encoding.uri_to_iri()' (bsc#1142885).\n- CVE-2019-12781: Fixed incorrect HTTP detection with reverse-proxy connecting via HTTPS (bsc#1139945).\n- CVE-2019-12308: Fixed a cross site scripting vulnerability in the AdminURLFieldWidget (bsc#1136468).\n","status":"published","published":"2019-09-09T10:09:00Z","modified":"2026-02-04T02:25:54.98095Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-4084-1","title":"python-django vulnerabilities","description":"It was discovered that Django incorrectly handled the Truncator function. A\nremote attacker could possibly use this issue to cause Django to consume\nresources, leading to a denial of service. (CVE-2019-14232)\n\nIt was discovered that Django incorrectly handled the strip_tags function.\nA remote attacker could possibly use this issue to cause Django to consume\nresources, leading to a denial of service. (CVE-2019-14233)\n\nIt was discovered that Django incorrectly handled certain lookups in the\nPostgreSQL support. A remote attacker could possibly use this issue to\nperform SQL injection attacks. (CVE-2019-14234)\n\nIt was discovered that Django incorrectly handled certain invalid UTF-8\noctet sequences. A remote attacker could possibly use this issue to cause\nDjango to consume resources, leading to a denial of service.\n(CVE-2019-14235)\n","status":"published","published":"2019-08-01T11:59:17Z","modified":"2026-04-27T15:27:31.260017Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}