SQL injection in Tortoise ORM
Moderate severity
GitHub Reviewed
Published
Apr 18, 2020
in
tortoise/tortoise-orm
•
Updated Jan 9, 2023
Package
Affected versions
< 0.15.23
>= 0.16.0, < 0.16.6
Patched versions
0.15.23
0.16.6
Description
Reviewed
Apr 20, 2020
Published to the GitHub Advisory Database
Apr 20, 2020
Last updated
Jan 9, 2023
Impact
Various forms of SQL injection has been found, for MySQL and when filtering or doing mass-updates on char/text fields.
SQLite & PostgreSQL was only affected when filtering with
contains,starts_withorends_withfilters (and their case-insensitive counterparts)Patches
Please upgrade to 0.15.23+ or 0.16.6+
For more information
If you have any questions or comments about this advisory:
References