Vulnerability Description
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Djangoproject | Django | >= 1.11, < 1.11.23 |
| Fedoraproject | Fedora | 30 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlMailing ListThird Party Advisory
- https://docs.djangoproject.com/en/dev/releases/security/Vendor Advisory
- https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://seclists.org/bugtraq/2019/Aug/15Mailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202004-17
- https://security.netapp.com/advisory/ntap-20190828-0002/
- https://www.debian.org/security/2019/dsa-4498Third Party Advisory
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases/Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlMailing ListThird Party Advisory
- https://docs.djangoproject.com/en/dev/releases/security/Vendor Advisory
- https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://seclists.org/bugtraq/2019/Aug/15Mailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202004-17
FAQ
What is CVE-2019-14234?
CVE-2019-14234 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.f...
How severe is CVE-2019-14234?
CVE-2019-14234 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-14234?
Check the references section above for vendor advisories and patch information. Affected products include: Djangoproject Django, Fedoraproject Fedora, Debian Debian Linux.