Published: 09/08/2019 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

An issue exists in Django 1.11.x prior to 1.11.23, 2.1.x prior to 2.1.11, and 2.2.x prior to 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.

Vulnerable Product	Search on Vulmon	Subscribe to Product
djangoproject django
fedoraproject fedora 30
debian debian linux 9.0
debian debian linux 10.0

Several security issues were fixed in Django ...

Debian Bug report logs - #934026 python-django: CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235 Package: python-django; Maintainer for python-django is Debian Python Modules Team <python-modules-team@listsaliothdebianorg>; Source for python-django is src:python-django (PTS, buildd, popcon) Reported by: "Chris ...

Synopsis Moderate: python-django security update Type/Severity Security Advisory: Moderate Topic An update for python-django is now available for Red Hat OpenStack Platform15 (Stein)Red Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System ...

Synopsis Moderate: python-django security update Type/Severity Security Advisory: Moderate Topic An update for python-django is now available for Red Hat OpenStack Platform13 (Queens)Red Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System ...

Several vulnerabilities were discovered in python-django, a web development framework They could lead to remote denial-of-service or SQL injection, For the oldstable distribution (stretch), these problems have been fixed in version 1:1107-2+deb9u6 For the stable distribution (buster), these problems have been fixed in version 11123-1~deb10u1 ...

Key and index lookups for JSONField and key lookups for HStoreField were subject to SQL injection, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySetfilter() ...

Permalink: wwwdjangoprojectcom/weblog/2019/aug/01/security-releases/ In accordance with `our security release policy <docsdjangoprojectcom/en/dev/internals/security/>`_, the Django team is issuing `Django 11123 <docsdjangoprojectcom/en/dev/releases/11123/>`_, `Django 2111 <docsdjangopro ...

POC-Django JSONField/HStoreField SQL Injection Vulnerability (CVE-2019-14234)

POC-Django JSONField/HStoreField SQL Injection Vulnerability Exploit (CVE-2019-14234) Django released a security update on August 1, 2019, which fixes a SQL injection vulnerability in the two model fields of JSONField and HStoreField Reference link: wwwdjangoprojectcom/weblog/2019/aug/01/security-releases/ wwwleavesongscom/PENETRATION/django-jsonfield-cve-2

漏洞demo

CVE_2019_14234 python 27x CentOS7 install python 27 curl "bootstrappypaio/get-pippy" -o "get-pippy" python get-pippy yum install gcc openssl-devel bzip2-devel python-devel -y install postgres via docker curl -sSL getdockercom/ | sudo sh usermod -aG docker root systemctl start docker docke

CWE-89 https://www.djangoproject.com/weblog/2019/aug/01/security-releases/https://docs.djangoproject.com/en/dev/releases/security/https://seclists.org/bugtraq/2019/Aug/15 https://www.debian.org/security/2019/dsa-4498 http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html https://security.netapp.com/advisory/ntap-20190828-0002/https://security.gentoo.org/glsa/202004-17 https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/https://nvd.nist.gov https://usn.ubuntu.com/4084-1/

CVE-2019-14234

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

Github Repositories

References

Vulmon Search

About

Products

Connect