CVE-2020-11010
SQL injection in Tortoise ORM
Summary
SQL injection in Tortoise ORM
Original description
The description as published by the source.
Impact
Various forms of SQL injection has been found, for MySQL and when filtering or doing mass-updates on char/text fields.
SQLite & PostgreSQL was only affected when filtering with contains, starts_with or ends_with filters (and their case-insensitive counterparts)
Patches
Please upgrade to 0.15.23+ or 0.16.6+
For more information
If you have any questions or comments about this advisory:
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
PyPI
tortoise-orm
[{"type":"ECOSYSTEM","events":[{"introduced":"0.16.0"},{"fixed":"0.16.6"}]}]
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com