GitHub Advisoryadvisory · PyPI

GHSA-9j2c-x8qm-qmjq SQL injection in Tortoise ORM

MEDIUM Published 2020-04-20 Modified 2024-11-13 Official page ↗
Aliases
CVE-2020-11010
Ecosystem
PyPI
Packages
tortoise-orm
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-89
Reviewed
2020-04-20

Affected packages

• PyPI tortoise-orm: < 0.15.23 → fixed in 0.15.23 • PyPI tortoise-orm: >= 0.16.0, < 0.16.6 → fixed in 0.16.6

Description

Impact Various forms of SQL injection has been found, for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL was only affected when filtering with ``contains``, ``starts_with`` or ``ends_with`` filters (and their case-insensitive counterparts) Patches Please upgrade to 0.15.23+ or 0.16.6+ For more information If you have any questions or comments about this advisory: • Open an issue in Github • Chat to us on Gitter

Related

Alias · CVE (1)

  • CVE-2020-11010 In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of SQL injection have been found for MySQL and when filtering or doing… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References