GHSA-9j2c-x8qm-qmjqMediumCVSS 6.3

SQL injection in Tortoise ORM

Published
April 20, 2020
Last Modified
November 13, 2024

🔗 CVE IDs covered (1)

CVE-2020-11010 →

📋 Description

Impact

Various forms of SQL injection has been found, for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL was only affected when filtering with contains, starts_with or ends_with filters (and their case-insensitive counterparts)

Patches

Please upgrade to 0.15.23+ or 0.16.6+

For more information

If you have any questions or comments about this advisory:

🎯 Affected products2

  • pip/tortoise-orm:< 0.15.23
  • pip/tortoise-orm:>= 0.16.0, < 0.16.6

🔗 References (5)