CVE-2020-11010
SQL injection in Tortoise ORM
Résumé
SQL injection in Tortoise ORM
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Impact
Various forms of SQL injection has been found, for MySQL and when filtering or doing mass-updates on char/text fields.
SQLite & PostgreSQL was only affected when filtering with contains, starts_with or ends_with filters (and their case-insensitive counterparts)
Patches
Please upgrade to 0.15.23+ or 0.16.6+
For more information
If you have any questions or comments about this advisory:
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
PyPI
tortoise-orm
[{"type":"ECOSYSTEM","events":[{"introduced":"0.16.0"},{"fixed":"0.16.6"}]}]
Références
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com