critical 9.8

CVE-2024-42005 in the critical feed json

Django SQL injection vulnerability

published 2024-08-07 2 y ago modified 2026-09-10 59 d ago also BIT-django-2024-42005 , EUVD-2024-0047 , GHSA-pv4p-cwwg-4rph , PYSEC-2024-70

cvss: 9.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.5%; EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits: 0; none known

An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.

Patch / fix

fixed in 3 distros 6 links 3

pypi django 4.2.15, 5.0.8
bitnami django 4.2.15, 5.0.8
djangoproject django 4.2.15, 5.0.8

debian ubuntu red hat suse opensuse alpine

python-django Debian 12 3:3.2.25-0+deb12u1
python-django Debian 14, Debian 13 3:4.2.15-1

debian advisories DEBIAN-CVE-2024-42005

python-django Ubuntu 22.04 LTS 2:3.2.12-2ubuntu1.13
python-django Ubuntu 24.04 LTS 3:4.2.11-1ubuntu1.2

ubuntu advisories UBUNTU-CVE-2024-42005

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

python-django rhui 4 4.2.15-1.el8ui
python-grpcio rhui 4 1.65.4-1.el8ui
python-jinja2 rhui 4 3.1.4-1.el8ui
python-aiohttp rhui 4 3.9.4-1.el8ui
python-gunicorn rhui 4 22.0.0-1.0.1.el8ui
python-requests rhui 4 2.32.3-2.el8ui
python-sqlparse rhui 4 0.5.0-1.el8ui
python3.11-django rhui 4 4.2.15-1.el8ui

red hat advisories RHSA-2025:1335 RHSA-2024:8906 RHSA-2024:6428

python-Django openSUSE Leap 15.5 2.0.7-150000.1.27.1
python-Django SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 4.2.11-150600.3.6.1

suse advisories SUSE-SU-2024:2817-1 SUSE-SU-2024:2816-1

python-Django5 openSUSE Tumbleweed 5.2.16-1.1
python-Django openSUSE Tumbleweed 5.2.16-1.1
python-Django4 openSUSE Tumbleweed 4.2.30-4.1
python-Django6 openSUSE Tumbleweed 6.0-1.1
python-Django Package Hub 15 SP5, openSUSE Leap 15.5 2.2.28-bp155.7.15.1
python-Django openSUSE Tumbleweed 5.0.8-1.1
python-Django4 openSUSE Tumbleweed 4.2.15-1.1

opensuse advisories openSUSE-SU-2026:11270-1 openSUSE-SU-2026:11248-1 openSUSE-SU-2026:11235-1 openSUSE-SU-2026:10005-1 openSUSE-SU-2024:0272-1 openSUSE-SU-2024:14247-1

py3-django Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 4.2.16-r0

alpine advisories ALPINE-CVE-2024-42005

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

github.com/django/django@32ebcbf commit
github.com/django/django@f4af67b commit
docs.djangoproject.com/en/dev/releases/security/ advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-42005 updated 2026-11-05 cvss 7.3

python-django: Potential SQL injection in QuerySet.values() and values_list()

Red Hat Ansible Automation Platform 2 python3.11-django 4.2.25-1.el9ap, ansible-automation-platform-25/lightspeed-rhel8
affected: workaround, no fix available
Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification
affected: workaround, no fix available “Fix deferred”
Red Hat Discovery 1 for RHEL 9 discovery/discovery-ui-rhel9 1.12.0-1, discovery/discovery-server-rhel9 1.12.0-1
fixed: vendor fix RHSA-2025:1249
Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-django 4.2.15-1.el8ap, python3x-django 4.2.15-1.el8ap, automation-controller-venv-tower 4.5.10-1.el8ap Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-django 4.2.15-1.el9ap, python3-django 4.2.15-1.el9ap, automation-controller-venv-tower 4.5.10-1.el9ap
fixed: vendor fix RHSA-2024:6428
Red Hat Satellite 6.16 for RHEL 8 python-django 4.2.16-1.el8pc, python3.11-django 4.2.16-1.el8pc Red Hat Satellite 6.16 for RHEL 9 python-django 4.2.16-1.el9pc, python3.11-django 4.2.16-1.el9pc
fixed: vendor fix RHSA-2024:8906
Red Hat RHUI 4 for RHEL 8 python-django 4.2.15-1.el8ui, python3.11-django 4.2.15-1.el8ui
fixed: vendor fix RHSA-2025:1335
Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/ee-dellemc-openmanage-rhel8, ansible-automation-platform-24/platform-resource-runner-rhel8 Red Hat Ansible Automation Platform 2.4 for RHEL 8 python39-zipp 3.19.2-1.el8ap, python39-grpcio 1.58.3-1.el8ap, python3x-grpcio 1.58.3-1.el8ap, python39-gunicorn 22.0.0-2.el8ap, python39-jmespath 0.10.0-5.el8ap, python3x-gunicorn 22.0.0-2.el8ap, +9 more Red Hat Ansible Automation Platform 2.4 for RHEL 9 python-zipp 3.19.2-1.el9ap, python3-zipp 3.19.2-1.el9ap, python-grpcio 1.58.3-1.el9ap, python3-grpcio 1.58.3-1.el9ap, python-gunicorn 22.0.0-2.el9ap, python-jmespath 0.10.0-5.el9ap, +10 more Red Hat Satellite 6.16 for RHEL 8 cjson 1.7.17-1.el8sat, libcomps 0.1.21-1.el8pc, libsolv 0.7.20-6.el8sat, python-jq 1.6.0-3.el8pc, python-pbr 5.8.0-7.el8pc, candlepin 4.4.16-1.el8sat, +675 more Red Hat Satellite 6.16 for RHEL 9 cjson 1.7.17-1.el9sat, libcomps 0.1.21-1.el9pc, python-jq 1.6.0-3.el9pc, python-pbr 5.8.0-7.el9pc, candlepin 4.4.16-1.el9sat, foreman 3.12.0.1-1.el9sat, +645 more Red Hat RHUI 4 for RHEL 8 libcomps 0.1.21-1.el8ui, python-jq 1.6.0-4.el8ui, python-xlrd 2.0.1-9.el8ui, python-xlwt 1.3.0-7.el8ui, python-yarl 1.8.2-5.el8ui, python-zipp 3.4.0-8.el8ui, +196 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: total
Assessed: 2 y ago (2024-08-16)

Exploit prediction

1.50% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OSV	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	django	>=5.0, <5.0.8 >=4.2, <4.2.15	5.0.8 4.2.15
bitnami	django	>=4.2.0, <4.2.15 >=5.0.0, <5.0.8	4.2.15 5.0.8

Affected products

djangoproject django

Classification

Weakness

CWE-89 Improper Neutralization of Special Elements used in an SQL Command

Technology feeds

Django rss critical rss

References

docs.djangoproject.com /en/dev/releases/security/
patch, vendor-advisory, advisory, web
github.com /django/django/commit/32ebcbf2e1fe3e5ba79a6554a167efce81f7422d
web
github.com /django/django/commit/f4af67b9b41e0f4c117a8741da3abbd1c869ab28
web
djangoproject.com /weblog/2024/aug/06/security-releases/
vendor-advisory, advisory, article
groups.google.com /forum/#%21forum/django-announce
web, not-applicable
security.netapp.com /advisory/ntap-20240905-0007/
web
nvd.nist.gov /vuln/detail/CVE-2024-42005
advisory, web
docs.djangoproject.com /en/dev/releases/security
web
github.com /django/django
package
github.com /pypa/advisory-database/tree/main/vulns/django/PYSEC-2024-70.yaml
web
security.netapp.com /advisory/ntap-20240905-0007
web
djangoproject.com /weblog/2024/aug/06/security-releases
web
github.com /advisories/GHSA-pv4p-cwwg-4rph
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary