Open Nav
Sign Up

Django Releases Security Updates to Address SQL Injection Flaw (CVE-2024-42005, CVSS 9.8)

Bar Refael

August 11, 2024

The Django team has released security updates for versions 5.0.8 and 4.2.15 to address multiple vulnerabilities, including a critical SQL injection flaw tracked as CVE-2024-42005 (CVSS 9.8). This critical vulnerability impacts the QuerySet.values() and values_list() methods on models with a JSONField, potentially allowing attackers to execute arbitrary SQL commands and gain unauthorized access to sensitive data. All Django users are strongly advised to update their installations immediately to mitigate these risks.

CVE-2024-42005: Critical SQL Injection Vulnerability

Description:

  • The critical flaw, CVE-2024-42005, affects the QuerySet.values() and values_list() methods on Django models containing a JSONField. By crafting specific JSON object keys, an attacker can exploit this vulnerability to execute arbitrary SQL commands, leading to unauthorized data access and manipulation.

Other Vulnerabilities:

  • CVE-2024-41989 (CVSS 7.5): Affects the floatformat template filter, which can consume excessive memory when processing specific numeric inputs in scientific notation.
  • CVE-2024-41990 (CVSS 7.5): The urlize() and urlizetrunc() template filters are susceptible to DoS attacks through large inputs with specific character sequences.
  • CVE-2024-41991 (CVSS 7.5): Similar to CVE-2024-41990, this affects urlize(), urlizetrunc(), and the AdminURLFieldWidget widget, allowing DoS attacks via inputs with a large number of Unicode characters.

Affected Versions

The vulnerabilities impact the following Django versions:

  • Django main branch
  • Django 5.1 (release candidate status)
  • Django 5.0 (prior to 5.0.8)
  • Django 4.2 (prior to 4.2.15)

Mitigation and Recommendations

Patched Versions:

  • Django 5.0.8
  • Django 4.2.15

Immediate Action Required:

  • Upgrade to Django 5.0.8 or 4.2.15 immediately to mitigate the risks associated with these vulnerabilities.
  • Regularly review and audit the use of JSONFields in Django applications to ensure secure handling and processing of data.

Conclusion

The release of these security updates is crucial for maintaining the security and integrity of Django-based applications, particularly due to the critical SQL injection vulnerability. All users are urged to apply the patches without delay to protect against potential exploitation.

Stay Secure. Stay Informed.

OP Innovate Research Team.

Resources highlights

Critical Zero-Day in Microsoft SharePoint Actively Exploited (CVE-2025-53770)

A newly discovered zero-day vulnerability in Microsoft SharePoint Server, tracked as CVE-2025-53770, is currently being exploited in active attacks against on-premises environments. The flaw, rated…

Read more >

CVE-2025-53770

Over 600 Laravel Applications Vulnerable to Remote Code Execution via Leaked APP_KEYs (CVE-2018-15133, CVE-2024-55556)

Security researchers have uncovered a major RCE threat affecting over 600 Laravel applications, triggered by leaked APP_KEYs found on public GitHub repositories. Laravel's APP_KEY, typically…

Read more >

CVE-2018-15133, CVE-2024-55556

CVE-2025-3648: “Count(er) Strike” Vulnerability in ServiceNow

CVE-2025-3648, dubbed “Count(er) Strike”, is a high-severity vulnerability (CVSS 8.2) in ServiceNow's Now Platform, discovered by Varonis Threat Labs. The flaw allows both authenticated and…

Read more >

CVE-2025-3648

What to Look for in a Pentesting Platform (Beyond Just Scans)

Penetration testing platforms are a great way to centralize vulnerability discovery and triage. However, when evaluating penetration testing platforms, many organizations make the mistake of…

Read more >

pentesting platform

CVE-2016-10033: Actively Exploited Remote Code Execution (RCE) Vulnerability in PHPMailer

CVE-2016-10033 is a critical remote code execution vulnerability in PHPMailer, a widely used PHP library for sending emails. The flaw lies in the mailSend function…

Read more >

CVE-2016-10033

High-Severity WordPress Vulnerability in Forminator Plugin (CVE-2025-6463)

A critical vulnerability in the Forminator plugin, one of the most popular form-building plugins in Wordpress, allows unauthenticated attackers to delete arbitrary files on the…

Read more >

CVE-2025-6463
Under Cyber Attack?

Fill out the form and we will contact you immediately.