Description
In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of SQL injection have been found for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL are only affected when filtering with contains, starts_with, or ends_with filters (and their case-insensitive counterparts).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tortoise | tortoise-orm | < 0.15.23, >= 0.16.0, < 0.16.6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | tortoise-orm | < 0.15.23 | 0.15.23 | GHSA-9j2c-x8qm-qmjq |
| PyPI | tortoise-orm | >= 0.16.0, < 0.16.6 | 0.16.6 | GHSA-9j2c-x8qm-qmjq |
| PyPI | tortoise-orm | < 0.15.23 · >= 0.16.0, < 0.16.6 | 0.15.23, 0.16.6 | PYSEC-2020-144 |