{"id":"CVE-2024-53908","aliases":["ALPINE-CVE-2024-53908","BIT-django-2024-53908","CLSA-2025-1762387903","CLSA-2026-1786600187","CLSA-2026-1787718360","CLSA-2026-1788165693","CLSA-2026-1792393048","DEBIAN-CVE-2024-53908","EUVD-2024-0049","GHSA-m9g8-fxxm-xg86","MGASA-2025-0039","OESA-2024-2539","OESA-2024-2540","OESA-2024-2541","OESA-2024-2543","PYSEC-2024-157","RHSA-2025:0340","RHSA-2025:0721","SUSE-SU-2024:4285-1","UBUNTU-CVE-2024-53908","USN-7136-1","openSUSE-SU-2024:14565-1","openSUSE-SU-2024:14568-1","openSUSE-SU-2026:10005-1","openSUSE-SU-2026:11270-1"],"status":"published","title":"Django SQL injection in HasKey(lhs, rhs) on Oracle","description":"An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.01415,"percentile":0.73097,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2024-12-04T15:00:00Z","modified":"2026-11-03T06:32:59Z","fixes":[{"ecosystem":"PyPI","package":"django","fixed_in":["5.0.10","5.1.4","4.2.17"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-django","fixed_in":["4.2.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-django","fixed_in":["4.2.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-django","fixed_in":["4.2.20-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-django","fixed_in":["4.2.20-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"django","fixed_in":["4.2.17","5.1.4"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"django","fixed_in":["5.0.2.post2+tuxcare","5.0.1.post5+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-django","fixed_in":["3:4.2.17-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-django","fixed_in":["3:4.2.17-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-django","fixed_in":["3:4.2.11-1ubuntu1.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.10"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.2.17"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1"},{"fixed":"5.1.4"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.0.10"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.17"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.20-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.20-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"django","ranges":[{"type":"SEMVER","events":[{"introduced":"4.2.0"},{"fixed":"4.2.17"},{"introduced":"5.0.0"},{"fixed":"5.1.4"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1"},{"fixed":"5.1.post3+tuxcare"}]}],"versions":["5.1","5.1.post1+tuxcare","5.1.post2+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.2"},{"fixed":"5.0.2.post2+tuxcare"}]}],"versions":["5.0.2","5.0.2.post1+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.1"},{"fixed":"5.0.1.post5+tuxcare"}]}],"versions":["5.0.1","5.0.1.post1+tuxcare","5.0.1.post2+tuxcare","5.0.1.post3+tuxcare","5.0.1.post4+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.0.post8+tuxcare"}]}],"versions":["5.0","5.0.post1+tuxcare","5.0.post2+tuxcare","5.0.post3+tuxcare","5.0.post4+tuxcare","5.0.post5+tuxcare","5.0.post6+tuxcare","5.0.post7+tuxcare"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.post17+tuxcare"}]}],"versions":["4.2","4.2.post1+tuxcare","4.2.post10+tuxcare","4.2.post11+tuxcare","4.2.post12+tuxcare","4.2.post13+tuxcare","4.2.post14+tuxcare","4.2.post15+tuxcare","4.2.post16+tuxcare","4.2.post2+tuxcare","4.2.post3+tuxcare","4.2.post4+tuxcare","4.2.post5+tuxcare","4.2.post6+tuxcare","4.2.post7+tuxcare","4.2.post8+tuxcare","4.2.post9+tuxcare"],"bundled":20},{"source":"osv","ecosystem":"Debian:13","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.17-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.17-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.10"}]}],"versions":["5.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.4"}]}],"versions":["5.1","5.1.1","5.1.2","5.1.3"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.2.17"}]}],"versions":["4.2","4.2.1","4.2.10","4.2.11","4.2.12","4.2.13","4.2.14","4.2.15","4.2.16","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1"},{"fixed":"5.1.4"}]}],"versions":["5.1","5.1.1","5.1.2","5.1.3"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"fixed":"5.0.10"}]}],"versions":["5.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9"]},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.17"}]}],"versions":["4.2","4.2.1","4.2.10","4.2.11","4.2.12","4.2.13","4.2.14","4.2.15","4.2.16","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.13-1.2.mga9"}]}],"bundled":13},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-3.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-3.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-3.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.15-3.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1"},{"fixed":"5.1.4"},{"introduced":"5.0"},{"fixed":"5.0.10"},{"introduced":"4.2"},{"fixed":"4.2.17"}]}],"versions":["4.2","4.2.1","4.2.10","4.2.11","4.2.12","4.2.13","4.2.14","4.2.15","4.2.16","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9","5.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5","5.0.6","5.0.7","5.0.8","5.0.9","5.1","5.1.1","5.1.2","5.1.3"]},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.6-1.el8ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.6-1.el9ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"python3.11-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el8ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"python3.11-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.11-1.el9ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el8","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20250115-1.el8ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.5::el9","package":"automation-gateway-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.20250115-1.el9ap"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.17-1.el8ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"automation-controller-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.17-1.el9ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python39-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-1.el8ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el8","package":"python3x-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-1.el8ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python39-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-1.el8ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el8","package":"python3x-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-1.el8ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python39-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-1.el8ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el8","package":"python3x-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-1.el8ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-1.el9ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_developer:2.4::el9","package":"python3-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-1.el9ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-1.el9ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform_inside:2.4::el9","package":"python3-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-1.el9ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-1.el9ap"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:ansible_automation_platform:2.4::el9","package":"python3-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-1.el9ap"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150600.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11-150600.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.11-1ubuntu1.4"}]}],"versions":["3:4.2.4-1ubuntu2","3:4.2.8-1","3:4.2.9-1","3:4.2.11-1","3:4.2.11-1ubuntu1","3:4.2.11-1ubuntu1.1","3:4.2.11-1ubuntu1.2","3:4.2.11-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.2.12-1ubuntu0.26"}]}],"versions":["1:1.11.22-1ubuntu1","2:2.2.6-1ubuntu1","2:2.2.9-2ubuntu1","2:2.2.10-1","2:2.2.10-1ubuntu1","2:2.2.11-1","2:2.2.12-1","2:2.2.12-1ubuntu0.1","2:2.2.12-1ubuntu0.2","2:2.2.12-1ubuntu0.3","2:2.2.12-1ubuntu0.4","2:2.2.12-1ubuntu0.5","2:2.2.12-1ubuntu0.6","2:2.2.12-1ubuntu0.7","2:2.2.12-1ubuntu0.8","2:2.2.12-1ubuntu0.9","2:2.2.12-1ubuntu0.10","2:2.2.12-1ubuntu0.11","2:2.2.12-1ubuntu0.12","2:2.2.12-1ubuntu0.13","2:2.2.12-1ubuntu0.14","2:2.2.12-1ubuntu0.15","2:2.2.12-1ubuntu0.16","2:2.2.12-1ubuntu0.17","2:2.2.12-1ubuntu0.18","2:2.2.12-1ubuntu0.19","2:2.2.12-1ubuntu0.20","2:2.2.12-1ubuntu0.21","2:2.2.12-1ubuntu0.22","2:2.2.12-1ubuntu0.23","2:2.2.12-1ubuntu0.24","2:2.2.12-1ubuntu0.25"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.2.12-2ubuntu1.15"}]}],"versions":["2:2.2.24-1ubuntu1","2:3.2.12-2","2:3.2.12-2ubuntu1","2:3.2.12-2ubuntu1.1","2:3.2.12-2ubuntu1.2","2:3.2.12-2ubuntu1.3","2:3.2.12-2ubuntu1.4","2:3.2.12-2ubuntu1.5","2:3.2.12-2ubuntu1.6","2:3.2.12-2ubuntu1.7","2:3.2.12-2ubuntu1.8","2:3.2.12-2ubuntu1.9","2:3.2.12-2ubuntu1.10","2:3.2.12-2ubuntu1.11","2:3.2.12-2ubuntu1.12","2:3.2.12-2ubuntu1.13","2:3.2.12-2ubuntu1.14"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.2.11-1ubuntu1.4"}]}],"versions":["3:4.2.4-1ubuntu2","3:4.2.8-1","3:4.2.9-1","3:4.2.11-1","3:4.2.11-1ubuntu1","3:4.2.11-1ubuntu1.1","3:4.2.11-1ubuntu1.2","3:4.2.11-1ubuntu1.3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.17-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.4-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-1.1"}]}],"bundled":70},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Django5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.16-1.1"}]}],"bundled":93}],"products":[{"vendor":"djangoproject","product":"django"}],"references":[{"url":"https://docs.djangoproject.com/en/dev/releases/security/","tags":["Patch","Vendor Advisory","advisory","web"]},{"url":"https://groups.google.com/g/django-announce","tags":["Release Notes","article","web"]},{"url":"https://www.openwall.com/lists/oss-security/2024/12/04/3","tags":["Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53908","tags":["web","advisory"]},{"url":"https://docs.djangoproject.com/en/dev/releases/security","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2024/dec/04/security-releases","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-157.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m9g8-fxxm-xg86","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-53908","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53908.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-53908","tags":["advisory"]},{"url":"https://github.com/django/django","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0039.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33919","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33387","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33507","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2024/07/09/3","tags":["web"]},{"url":"https://www.djangoproject.com/weblog/2024/jul/09/security-releases/","tags":["web"]},{"url":"https://openwall.com/lists/oss-security/2024/08/06/2","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2024/09/03/3","tags":["web"]},{"url":"https://openwall.com/lists/oss-security/2024/12/04/3","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/01/14/2","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-7205-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2539","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53907","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2540","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2541","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2543","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0340","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2327130","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2329003","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2329287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2329288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331063","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0340.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-11407","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-11407","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11407","tags":["advisory"]},{"url":"https://github.com/grpc/grpc/commit/e9046b2bbebc0cb7f5dc42008f807f6c7e98e791","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-52304","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-52304","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52304","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/commit/259edc369075de63e6f3a4eaade058c62af0df71","tags":["article"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8495-4g3g-x7pr","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-53907","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53907","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2024/dec/04/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-53908","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53908","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-55565","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-55565","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55565","tags":["advisory"]},{"url":"https://github.com/ai/nanoid/compare/3.3.7...3.3.8","tags":["article"]},{"url":"https://github.com/ai/nanoid/pull/510","tags":["article"]},{"url":"https://github.com/ai/nanoid/releases/tag/5.0.9","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:0721","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2333854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2333856","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_0721.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-56201","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-56201","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56201","tags":["advisory"]},{"url":"https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f","tags":["article"]},{"url":"https://github.com/pallets/jinja/issues/1792","tags":["article"]},{"url":"https://github.com/pallets/jinja/releases/tag/3.1.5","tags":["article"]},{"url":"https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-56326","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-56326","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56326","tags":["advisory"]},{"url":"https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4","tags":["article"]},{"url":"https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244285-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234231","tags":["report"]},{"url":"https://bugzilla.suse.com/1234232","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53908","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-53908","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7136-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-53907","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MHKGQNDWTHDRJRVCAHBUJ2GNSMMLYCOB/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LA55S66UV3FC6U27FOZZSUCLZQYOMINJ/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-6188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-35042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-34265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-41323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-36053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-43665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42005","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-26699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-57833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33034","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-35193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48588","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8404","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-53908","description":"An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)","status":"published","published":"2024-12-06T00:00:00Z","modified":"2024-12-06T16:22:02.446Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:34:17.865042Z"}],"euvd":[{"id":"EUVD-2024-0049","description":"An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)","status":"published","published":"2024-12-06T00:00:00Z","modified":"2024-12-06T16:22:02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:39.149757Z"}],"ghsa":[{"id":"GHSA-m9g8-fxxm-xg86","title":"Django SQL injection in HasKey(lhs, rhs) on Oracle","description":"An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)","status":"published","published":"2024-12-06T12:30:47Z","modified":"2025-01-14T16:37:43Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:38:27.067633Z"}],"nvd":[{"id":"CVE-2024-53908","description":"An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)","status":"published","published":"2024-12-06T12:15:18.583Z","modified":"2026-06-17T08:09:28.87Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:10:39.434419Z"}],"osv":[{"id":"ALPINE-CVE-2024-53908","description":"An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)","status":"published","published":"2024-12-06T12:15:18.583Z","modified":"2026-11-03T06:32:59.937680948Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"CVE-2024-53908","description":"An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)","status":"published","published":"2024-12-06T00:00:00Z","modified":"2026-10-28T02:30:31.291848242Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:44.451316Z"},{"id":"DEBIAN-CVE-2024-53908","description":"An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)","status":"published","published":"2024-12-06T12:15:18.583Z","modified":"2026-11-02T12:03:14.99226091Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:44.429177Z"},{"id":"GHSA-m9g8-fxxm-xg86","title":"Django SQL injection in HasKey(lhs, rhs) on Oracle","description":"An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)","status":"published","published":"2024-12-06T12:30:47Z","modified":"2026-09-10T03:50:21.66981485Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"OESA-2024-2539","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability was found in the Django Web Framework. The strip_tags() and stripbtags template filter may be vulnerable to a potential denial of service (DoS) in cases of a large sequence of nested incomplete HTML entities.(CVE-2024-53907)\r\n\r\nA vulnerability was found in the Django Web Framework. The direct usage of django.db.models.fields.json.HasKey may be vulnerable to SQL injection if untrusted data is used to perform queries.(CVE-2024-53908)","status":"published","published":"2024-12-13T11:08:01Z","modified":"2026-08-18T01:17:43.871416985Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2540","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability was found in the Django Web Framework. The strip_tags() and stripbtags template filter may be vulnerable to a potential denial of service (DoS) in cases of a large sequence of nested incomplete HTML entities.(CVE-2024-53907)\r\n\r\nA vulnerability was found in the Django Web Framework. The direct usage of django.db.models.fields.json.HasKey may be vulnerable to SQL injection if untrusted data is used to perform queries.(CVE-2024-53908)","status":"published","published":"2024-12-13T11:08:01Z","modified":"2026-08-18T01:18:43.082210104Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2541","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability was found in the Django Web Framework. The strip_tags() and stripbtags template filter may be vulnerable to a potential denial of service (DoS) in cases of a large sequence of nested incomplete HTML entities.(CVE-2024-53907)\r\n\r\nA vulnerability was found in the Django Web Framework. The direct usage of django.db.models.fields.json.HasKey may be vulnerable to SQL injection if untrusted data is used to perform queries.(CVE-2024-53908)","status":"published","published":"2024-12-13T11:08:01Z","modified":"2026-08-18T01:18:43.127177271Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2024-2543","title":"python-django security update","description":"A high-level Python Web framework that encourages rapid development and clean, pragmatic design.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability was found in the Django Web Framework. The strip_tags() and stripbtags template filter may be vulnerable to a potential denial of service (DoS) in cases of a large sequence of nested incomplete HTML entities.(CVE-2024-53907)\r\n\r\nA vulnerability was found in the Django Web Framework. The direct usage of django.db.models.fields.json.HasKey may be vulnerable to SQL injection if untrusted data is used to perform queries.(CVE-2024-53908)","status":"published","published":"2024-12-13T11:08:01Z","modified":"2026-08-18T01:17:43.881573332Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"RHSA-2025:0340","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","status":"published","published":"2025-01-16T10:02:24Z","modified":"2026-10-16T10:05:57Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:0721","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update","status":"published","published":"2025-01-29T10:04:00Z","modified":"2026-10-16T10:06:08Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"UBUNTU-CVE-2024-53908","description":"An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)","status":"published","published":"2024-12-04T15:00:00Z","modified":"2026-02-04T04:25:11.116762Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:11.182485Z"},{"id":"BIT-django-2024-53908","description":"An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)","status":"published","published":"2025-03-10T08:13:29.171Z","modified":"2026-09-08T08:46:33.042492536Z","updated_at":"2026-11-02T15:28:29.152062Z"},{"id":"CLSA-2025-1762387903","title":"TuxCare security update for django (3 CVEs)","description":"TuxCare rebuilt django to address 3 CVEs. Fixed in 5.1.post3+tuxcare.","status":"published","published":"2026-08-04T14:52:08Z","modified":"2026-10-15T09:48:00.626546495Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2026-1786600187","title":"TuxCare security update for django (1 CVE)","description":"TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.2.post2+tuxcare.","status":"published","published":"2026-08-13T05:49:47Z","modified":"2026-10-15T09:48:05.52584604Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787718360","title":"TuxCare security update for django (1 CVE)","description":"TuxCare rebuilt django to address 1 CVE. Fixed in 5.0.1.post5+tuxcare.","status":"published","published":"2026-08-26T04:26:00Z","modified":"2026-10-15T09:48:05.839115679Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788165693","title":"TuxCare security update for django (3 CVEs)","description":"TuxCare rebuilt django to address 3 CVEs. Fixed in 5.0.post8+tuxcare.","status":"published","published":"2026-08-31T08:41:33Z","modified":"2026-10-15T09:48:05.835872039Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1792393048","title":"TuxCare security update for django (20 CVEs)","description":"TuxCare rebuilt django to address 20 CVEs. Fixed in 4.2.post17+tuxcare.","status":"published","published":"2026-10-19T06:57:28Z","modified":"2026-10-19T13:30:08.114607458Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"MGASA-2025-0039","title":"Updated python-django packages fix security vulnerabilities","description":"An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before\n5.0.7. urlize and urlizetrunc were subject to a potential denial of\nservice attack via certain inputs with a very large number of brackets.\n(CVE-2024-38875)\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before\n4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate()\nmethod allows remote attackers to enumerate users via a timing attack\ninvolving login requests for users with an unusable password.\n(CVE-2024-39329)\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before\n4.2.14. Derived classes of the django.core.files.storage.Storage base\nclass, when they override generate_filename() without replicating the\nfile-path validations from the parent class, potentially allow directory\ntraversal via certain inputs during a save() call. (CVE-2024-39330)\nAn issue was discovered in Django 5.0 before 5.0.7 and 4.2 before\n4.2.14. get_supported_language_variant() was subject to a potential\ndenial-of-service attack when used with very long strings containing\nspecific characters. (CVE-2024-39614)\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before\n4.2.15. The floatformat template filter is subject to significant memory\nconsumption when given a string representation of a number in scientific\nnotation with a large exponent. (CVE-2024-41989)\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before\n4.2.15. The urlize() and urlizetrunc() template filters are subject to a\npotential denial-of-service attack via very large inputs with a specific\nsequence of characters. (CVE-2024-41990)\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before\n4.2.15. The urlize and urlizetrunc template filters, and the\nAdminURLFieldWidget widget, are subject to a potential denial-of-service\nattack via certain inputs with a very large number of Unicode\ncharacters. (CVE-2024-41991)\nAn issue was discovered in Django 5.0 before 5.0.8 and 4.2 before\n4.2.15. QuerySet.values() and values_list() methods on models with a\nJSONField are subject to SQL injection in column aliases via a crafted\nJSON object key as a passed *arg. (CVE-2024-42005)\nAn issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9,\nand 4.2 before 4.2.16. The urlize() and urlizetrunc() template filters\nare subject to a potential denial-of-service attack via very large\ninputs with a specific sequence of characters. (CVE-2024-45230)\nAn issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16. The\ndjango.contrib.auth.forms.PasswordResetForm class, when used in a view\nimplementing password reset flows, allows remote attackers to enumerate\nuser e-mail addresses by sending password reset requests and observing\nthe outcome (only when e-mail sending is consistently failing).\n(CVE-2024-45231)\nAn issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10,\nand 4.2 before 4.2.17. The strip_tags() method and striptags template\nfilter are subject to a potential denial-of-service attack via certain\ninputs containing large sequences of nested incomplete HTML entities.\n(CVE-2024-53907)\nAn issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10,\nand 4.2 before 4.2.17. Direct usage of the\ndjango.db.models.fields.json.HasKey lookup, when an Oracle database is\nused, is subject to SQL injection if untrusted data is used as an lhs\nvalue. (CVE-2024-53908)\nAn issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11,\nand 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings\npassed when performing IPv6 validation could lead to a potential\ndenial-of-service attack. The undocumented and private functions\nclean_ipv6_address and is_valid_ipv6_address are vulnerable, as is the\ndjango.forms.GenericIPAddressField form field. (CVE-2024-56374)\n","status":"published","published":"2025-02-05T19:51:21Z","modified":"2026-04-16T04:44:08.897044559Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14565-1","title":"python310-Django4-4.2.17-1.1 on GA media","description":"These are all security issues fixed in the python310-Django4-4.2.17-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-09T00:00:00Z","modified":"2026-02-04T03:34:37.473369Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2024:14568-1","title":"python310-Django-5.1.4-1.1 on GA media","description":"These are all security issues fixed in the python310-Django-5.1.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-11T00:00:00Z","modified":"2026-02-04T04:18:49.63891Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2026:10005-1","title":"python312-Django6-6.0-1.1 on GA media","description":"These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-03T00:00:00Z","modified":"2026-03-23T04:54:19.792844Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:11270-1","title":"python313-Django5-5.2.16-1.1 on GA media","description":"These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-14T00:00:00Z","modified":"2026-07-15T10:00:11.454078308Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2024-157","description":"An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)","status":"published","published":"2024-12-06T12:15:18Z","modified":"2026-06-10T17:00:52.480540453Z","updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"SUSE-SU-2024:4285-1","title":"Security update for python-Django","description":"This update for python-Django fixes the following issues:\n\n  - CVE-2024-53907: Fixed denial-of-service in django.utils.html.strip_tags() (bsc#1234232)\n  - CVE-2024-53908: Fixed SQL injection in HasKey(lhs, rhs) on Oracle (bsc#1234231)\n","status":"published","published":"2024-12-11T08:30:20Z","modified":"2026-02-04T03:03:04.052867Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"USN-7136-1","title":"python-django vulnerabilities","description":"jiangniao discovered that Django incorrectly handled the API to strip tags.\nA remote attacker could possibly use this issue to cause Django to\nconsume resources, leading to a denial of service. (CVE-2024-53907)\n\nSeokchan Yoon discovered that Django incorrectly handled HasKey lookups\nwhen using Oracle. A remote attacker could possibly use this issue to\ninject arbitrary SQL code. This issue only affected Ubuntu 24.04 LTS and\nUbuntu 24.10. (CVE-2024-53908)\n","status":"published","published":"2024-12-04T18:04:14Z","modified":"2026-04-27T17:47:13.901784194Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}