CVE-2024-53908

Name of the Vulnerable Software and Affected Versions: Django versions 4.2 through 4.2.17 Django versions 5.0 through 5.0.10 Django versions 5.1 through 5.1.4

Description: An issue was discovered in Django when using an Oracle database. Direct usage of the django.db.models.fields.json.HasKey lookup is subject to SQL injection if untrusted data is used as an lhs value. This issue can be exploited by a remote attacker to execute arbitrary SQL code by sending a specially crafted request.

Recommendations: For Django versions 4.2 through 4.2.17, upgrade to version 4.2.17 or later. For Django versions 5.0 through 5.0.10, upgrade to version 5.0.10 or later. For Django versions 5.1 through 5.1.4, upgrade to version 5.1.4 or later. As a temporary workaround, consider avoiding the use of the django.db.models.fields.json.HasKey lookup with untrusted data until a patch is applied.