An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x…
Priority HIGH 72CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 3 fixed, 9 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-89.
Summary
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
Why it matters now
EPSS 0.47694 98th percentileScored 2026-11-07
Fix Partial Django (PyPI): 1.11.23, 2.1.11, 2.2.4Red Hat: 2 advisoriesRed Hat: 3 fixed, 9 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | Django (PyPI) | 1.11a1 to before 1.11.23 | 1.11.23 | Patch available | GHSA-6r97-cj55-9hrq |
| — | Django (PyPI) | 2.1a1 to before 2.1.11 | 2.1.11 | Patch available | GHSA-6r97-cj55-9hrq |
| — | Django (PyPI) | 2.2a1 to before 2.2.4 | 2.2.4 | Patch available | GHSA-6r97-cj55-9hrq |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- Django (PyPI) Vendor— Affected 1.11a1 to before 1.11.23 Fixed in 1.11.23 Patch available GHSA-6r97-cj55-9hrq
- Django (PyPI) Vendor— Affected 2.1a1 to before 2.1.11 Fixed in 2.1.11 Patch available GHSA-6r97-cj55-9hrq
- Django (PyPI) Vendor— Affected 2.2a1 to before 2.2.4 Fixed in 2.2.4 Patch available GHSA-6r97-cj55-9hrq
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* | 1.11 to before 1.11.23; 2.1 to before 2.1.11; 2.2 to before 2.2.4 | Vulnerable | djangoproject |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions 1.11 to before 1.11.23; 2.1 to before 2.1.11; 2.2 to before 2.2.4 Vulnerable ·djangoproject
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-6r97-cj55-9hrq Django (PyPI) Fixed in 1.11.23 Advisory →
- Fix · GHSA-6r97-cj55-9hrq Django (PyPI) Fixed in 2.1.11 Advisory →
- Fix · GHSA-6r97-cj55-9hrq Django (PyPI) Fixed in 2.2.4 Advisory →
Red Hat 2 advisories
- RHSA-2020:4390 Released 2020-10-28 · Red Hat rating Moderatepython-django security update
- Red Hat OpenStack Platform 13.0 python-django-1.11.27-1.el7ost, python-django-bash-completion-1.11.27-1.el7ost, python2-django-1.11.27-1.el7ost
- Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server python-django-1.11.27-1.el7ost, python-django-bash-completion-1.11.27-1.el7ost, python2-django-1.11.27-1.el7ost
- RHSA-2020:1324 Released 2020-04-06 · Red Hat rating Moderatepython-django security update
- Red Hat OpenStack Platform 15.0 python-django-2.1.11-1.el8ost, python-django-bash-completion-2.1.11-1.el8ost, python3-django-2.1.11-1.el8ost
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Certification for Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 14 (Rocky) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 9 (Mitaka) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 9 (Mitaka) Operational Tools | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix yet: Fix deferred |
| Red Hat Update Infrastructure 3 for Cloud Providers | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 13.0 | Fixed | RHSA-2020:4390 |
| Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server | Fixed | RHSA-2020:4390 |
| Red Hat OpenStack Platform 15.0 | Fixed | RHSA-2020:1324 |
Not affected: 2 products
- Red Hat Ceph Storage 2
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2019-14234
- 2026-10-03 Alias added: GHSA-6r97-cj55-9hrq
References
Advisory 9
- https://docs.djangoproject.com/en/dev/releases/security/
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases/
- 20190812 [SECURITY] [DSA 4498-1] python-django security update
- DSA-4498
- openSUSE-SU-2019:1872
- FEDORA-2019-647f74ce51
- GLSA-202004-17
- https://nvd.nist.gov/vuln/detail/CVE-2019-14234
- https://github.com/advisories/GHSA-6r97-cj55-9hrq
Other 12
- https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
- https://security.netapp.com/advisory/ntap-20190828-0002/
- https://github.com/django/django/commit/4f5b58f5cd3c57fee9972ab074f8dc6895d8f387
- https://github.com/django/django/commit/ed682a24fca774818542757651bfba576c3fc3ef
- https://github.com/django/django/commit/f74b3ae3628c26e1b4f8db3d13a91d52a833a975
- https://docs.djangoproject.com/en/dev/releases/security
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2019-13.yaml
- https://groups.google.com/forum/#!topic/django-announce/jIoju2-KLDs
- https://lists.fedoraproject.org/archives/list/[email protected]/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK
- https://security.netapp.com/advisory/ntap-20190828-0002
- https://www.djangoproject.com/weblog/2019/aug/01/security-releases
Sources
- CVE-2019-14234 · CVE Program
- CVE-2019-14234 · NVD
- FIRST EPSS
- GHSA-6r97-cj55-9hrq · GitHub Advisory Database · CC BY 4.0
- CVE-2019-14234 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences