Description
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-django | 3:4.2.17-1 | — |
| Debian 13 | python-django | 3:4.2.17-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | python-django | 3:4.2.11-1ubuntu1.4 | USN-7136-1 |
| Ubuntu 22.04 LTS | python-django | 2:3.2.12-2ubuntu1.15 | USN-7136-1 |
| Ubuntu 20.04 LTS | python-django | 2:2.2.12-1ubuntu0.26 | USN-7136-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Inside 2 | python-jinja2 +1 | 3.1.5-1.el9ap | RHSA-2025:0721 |
| Red Hat Ansible Automation Platform Inside 2 | python39-jinja2 +1 | 3.1.5-1.el8ap | RHSA-2025:0721 |
| Red Hat Ansible Automation Platform Developer 2 | python-jinja2 +1 | 3.1.5-1.el9ap | RHSA-2025:0721 |
| Red Hat Ansible Automation Platform Developer 2 | python39-jinja2 +1 | 3.1.5-1.el8ap | RHSA-2025:0721 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.5.17-1.el8ap | RHSA-2025:0721, RHSA-2025:0340 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.5.20250115-1.el8ap | RHSA-2025:0340 |
| Red Hat Ansible Automation Platform 2 | python-jinja2 +1 | 3.1.5-1.el9ap | RHSA-2025:0721 |
| Red Hat Ansible Automation Platform 2 | python3.11-aiohttp | 3.10.11-1.el8ap | RHSA-2025:0340 |
| Red Hat Ansible Automation Platform 2 | python39-jinja2 +1 | 3.1.5-1.el8ap | RHSA-2025:0721 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | python-Django | 4.2.11-150600.3.12.1 | SUSE-SU-2024:4285-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Django | 5.1.4-1.1 | openSUSE-SU-2024:14568-1 |
| openSUSE Tumbleweed | python-Django4 | 4.2.17-1.1 | openSUSE-SU-2024:14565-1 |
| openSUSE Tumbleweed | python-Django5 | 5.2.16-1.1 | openSUSE-SU-2026:11270-1 |
| openSUSE Tumbleweed | python-Django6 | 6.0-1.1 | openSUSE-SU-2026:10005-1 |
| openSUSE Leap 15.6 | python-Django | 4.2.11-150600.3.12.1 | SUSE-SU-2024:4285-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | py3-django | 4.2.20-r0 | — |
| Alpine v3.23 | py3-django | 4.2.20-r0 | — |
| Alpine v3.22 | py3-django | 4.2.20-r0 | — |
| Alpine v3.21 | py3-django | 4.2.20-r0 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | py3-django | 5.1.4-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | >= 5.0.0, < 5.0.10 | 5.0.10 | GHSA-m9g8-fxxm-xg86 |
| PyPI | django | >= 5.1.0, < 5.1.4 | 5.1.4 | GHSA-m9g8-fxxm-xg86 |
| PyPI | django | >= 4.2.0, < 4.2.17 | 4.2.17 | GHSA-m9g8-fxxm-xg86 |
| PyPI | django | >= 5.1, < 5.1.4 | 5.1.4 | GHSA-m9g8-fxxm-xg86 |
| PyPI | django | >= 5.0, < 5.0.10 | 5.0.10 | GHSA-m9g8-fxxm-xg86 |
| PyPI | django | >= 4.2, < 4.2.17 | 4.2.17 | GHSA-m9g8-fxxm-xg86 |
| PyPI | django | >= 5.1, < 5.1.4 · >= 5.0, < 5.0.10 · >= 4.2, < 4.2.17 | 5.1.4, 5.0.10, 4.2.17 | PYSEC-2024-157 |
Advisories 9
- RHSA-2025:0721 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2025:0340 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- openSUSE-SU-2026:11270-1 python313-Django5-5.2.16-1.1 on GA media SUSE / openSUSE Security Updates · Jul 15, 2026
- USN-7136-1 python-django vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2026:10005-1 python312-Django6-6.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2024-3609 Django: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 15, 2026
- openSUSE-SU-2024:14568-1 python310-Django-5.1.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14565-1 python310-Django4-4.2.17-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4285-1 Security update for python-Django SUSE / openSUSE Security Updates · Feb 4, 2026