Arch Linux Security Advisory ASA-202107-11 ========================================== Severity: High Date : 2021-07-03 CVE-ID : CVE-2021-35042 Package : python-django Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-2123 Summary ======= The package python-django before version 3.2.5-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 3.2.5-1. # pacman -Syu "python-django>=3.2.5-1" The problem has been fixed upstream in version 3.2.5. Workaround ========== None. Description =========== A security issue has been found in Django before version 3.2.5. Unsanitized user input passed to QuerySet.order_by() could bypass intended column reference validation in path marked for deprecation resulting in a potential SQL injection even if a deprecation warning is emitted. As a mitigation the strict column reference validation was restored for the duration of the deprecation period. Impact ====== A remote attacker is able to perform a SQL injection via unsanitized user input passed to QuerySet.order_by(). References ========== https://docs.djangoproject.com/en/3.2/releases/3.2.5/#cve-2021-35042-potenti... https://github.com/django/django/commit/a34a5f724c5d5adb2109374ba3989ebb7b11... https://security.archlinux.org/CVE-2021-35042