Description
Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Django | 3.2.7-2.3 | openSUSE-SU-2026:11248-1, openSUSE-SU-2024:13887-1, openSUSE-SU-2024:11205-1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.14-1.1 | openSUSE-SU-2026:11235-1, openSUSE-SU-2024:14208-1 |
| openSUSE Tumbleweed | python-Django5 | 5.2.16-1.1 | openSUSE-SU-2026:11270-1 |
| openSUSE Tumbleweed | python-Django6 | 6.0-1.1 | openSUSE-SU-2026:10005-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-django | 3.1.13-r0 | — |
| Alpine v3.23 | py3-django | 3.1.13-r0 | — |
| Alpine v3.22 | py3-django | 3.1.13-r0 | — |
| Alpine v3.21 | py3-django | 3.1.13-r0 | — |
| Alpine v3.20 | py3-django | 3.1.13-r0 | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | py3-django | 3.1.13-r0 | — |
| Alpine v3.18 | py3-django | 3.1.13-r0 | — |
| Alpine v3.17 | py3-django | 3.1.13-r0 | — |
| Alpine v3.16 | py3-django | 3.1.13-r0 | — |
| Alpine v3.15 | py3-django | 3.1.13-r0 | — |
| Alpine v3.14 | py3-django | 3.1.13-r0 | — |
| Alpine v3.13 | py3-django | 3.1.13-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 6 repositories
-
YouGina/CVE-2021-35042 ★ 13 · Jul 10, 2021
SQL injection via unsanitized QuerySet.order_by() input
-
r4vi/CVE-2021-35042 ★ 5 · Sep 24, 2021
-
zer0qs/CVE-2021-35042 ★ 2 · Apr 25, 2022
A basic analysis about CVE-2021-35942. SQL injection in Django.
-
vutiendat323/INT14107_CVE-2021-35042 ★ 0 · Apr 17, 2026
-
LUUANHDUC/CVE-2021-35042 ★ 0 · May 18, 2023
Django SQL injection vulnerability
-
mrlihd/CVE-2021-35042 ★ 0 · Sep 1, 2021
Reproduce CVE-2021-35042
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | >= 3.2a1, < 3.2.5 | 3.2.5 | GHSA-xpfp-f569-q3p2 |
| PyPI | django | >= 3.0a1, < 3.1.13 | 3.1.13 | GHSA-xpfp-f569-q3p2 |
| PyPI | django | >= 3.1, < 3.1.13 · >= 3.2, < 3.2.5 | 3.1.13, 3.2.5 | PYSEC-2021-109 |
Advisories 7
- openSUSE-SU-2026:11270-1 python313-Django5-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 15, 2026
- openSUSE-SU-2026:11248-1 python313-Django-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 11, 2026
- openSUSE-SU-2026:11235-1 python313-Django4-4.2.30-4.1 on GA media SUSE / openSUSE Security Updates · Jul 10, 2026
- openSUSE-SU-2026:10005-1 python312-Django6-6.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2024:11205-1 python36-Django-3.2.7-2.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13887-1 python310-Django-4.2.11-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14208-1 python310-Django4-4.2.14-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://groups.google.com/forum/#%21forum/django-announce
- https://docs.djangoproject.com/en/3.2/releases/security/
- https://www.openwall.com/lists/oss-security/2021/07/02/2
- https://www.djangoproject.com/weblog/2021/jul/01/security-releases/
- https://security.netapp.com/advisory/ntap-20210805-0008/
- FEDORA-2021-78e501d62a vendor-advisory