Open Nav
Sign Up

Django Releases Security Updates to Address SQL Injection Flaw (CVE-2024-42005, CVSS 9.8)

Bar Refael

August 11, 2024

The Django team has released security updates for versions 5.0.8 and 4.2.15 to address multiple vulnerabilities, including a critical SQL injection flaw tracked as CVE-2024-42005 (CVSS 9.8). This critical vulnerability impacts the QuerySet.values() and values_list() methods on models with a JSONField, potentially allowing attackers to execute arbitrary SQL commands and gain unauthorized access to sensitive data. All Django users are strongly advised to update their installations immediately to mitigate these risks.

CVE-2024-42005: Critical SQL Injection Vulnerability

Description:

  • The critical flaw, CVE-2024-42005, affects the QuerySet.values() and values_list() methods on Django models containing a JSONField. By crafting specific JSON object keys, an attacker can exploit this vulnerability to execute arbitrary SQL commands, leading to unauthorized data access and manipulation.

Other Vulnerabilities:

  • CVE-2024-41989 (CVSS 7.5): Affects the floatformat template filter, which can consume excessive memory when processing specific numeric inputs in scientific notation.
  • CVE-2024-41990 (CVSS 7.5): The urlize() and urlizetrunc() template filters are susceptible to DoS attacks through large inputs with specific character sequences.
  • CVE-2024-41991 (CVSS 7.5): Similar to CVE-2024-41990, this affects urlize(), urlizetrunc(), and the AdminURLFieldWidget widget, allowing DoS attacks via inputs with a large number of Unicode characters.

Affected Versions

The vulnerabilities impact the following Django versions:

  • Django main branch
  • Django 5.1 (release candidate status)
  • Django 5.0 (prior to 5.0.8)
  • Django 4.2 (prior to 4.2.15)

Mitigation and Recommendations

Patched Versions:

  • Django 5.0.8
  • Django 4.2.15

Immediate Action Required:

  • Upgrade to Django 5.0.8 or 4.2.15 immediately to mitigate the risks associated with these vulnerabilities.
  • Regularly review and audit the use of JSONFields in Django applications to ensure secure handling and processing of data.

Conclusion

The release of these security updates is crucial for maintaining the security and integrity of Django-based applications, particularly due to the critical SQL injection vulnerability. All users are urged to apply the patches without delay to protect against potential exploitation.

Stay Secure. Stay Informed.

OP Innovate Research Team.

Resources highlights

Critical Cisco ISE Vulnerabilities Lead to Unauthenticated RCE (CVE-2025-20281 & CVE-2025-20282)

On June 25, 2025, Cisco disclosed and patched two critical remote code execution (RCE) vulnerabilities: CVE-2025-20281 and CVE-2025-20282, affecting its widely deployed Identity Services Engine…

Read more >

CVE-2025-20281 & CVE-2025-20282

Critical Vulnerability in MegaRAC BMC Added to CISA’s KEV: CVE-2024-54085

On June 25, 2025, CISA added CVE‑2024‑54085, a critical authentication bypass vulnerability in the MegaRAC SPx Baseboard Management Controller (BMC) firmware, to its Known Exploited…

Read more >

CVE-2024-54085

‘UMBRELLA STAND’ Malware Targets Fortinet FortiGate Firewalls

‘UMBRELLA STAND’ Malware Targets Fortinet FortiGate Firewalls The UK’s National Cyber Security Centre (NCSC) has issued an alert regarding a sophisticated malware campaign dubbed “UMBRELLA…

Read more >

umbrella stand fortinet

CVE-2025-49144: Privilege Escalation in Notepad++ Installer Enables Full SYSTEM Access

A critical local privilege escalation vulnerability in the Notepad++ v8.8.1 installer allows attackers to escalate to NT AUTHORITY\SYSTEM using binary planting techniques. Tracked as CVE-2025-49144,…

Read more >

CVE-2025-49144

Our Red Team’s Favorite Penetration Testing Tools in 2025 (And How We Use Them)

When it comes to red team operations, the tools you choose can make or break the engagement. From initial reconnaissance to post-exploitation, having a streamlined,…

Read more >

pentesting tools - op

New Linux Vulnerabilities (CVE-2025-6018 & CVE-2025-6019) Enable Full Root Access in Seconds

Security researchers have uncovered a critical privilege escalation chain in major Linux distributions that allows any local user with a session (SSH or GUI) to…

Read more >

CVE-2025-6018, CVE-2025-6019
Under Cyber Attack?

Fill out the form and we will contact you immediately.