SQL injection in Tortoise ORM

高 8.8CVE-2020-11010 · GHSA-9j2c-x8qm-qmjq · PYSEC-2020-144 · 20/04/2020 公開 · 17/06/2026 更新

要点

CVE-2020-11010 は tortoise-orm, tortoise orm (tortoise orm project) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.1%（全脆弱性の 64.6% より高い）。
対処：0.16.6, 0.15.23 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
tortoise-orm PyPI	`≥ 0.16.0, < 0.16.6< 0.15.23`	`0.16.60.15.23`
tortoise orm tortoise_orm_project	`≥ 0.16.0, < 0.16.6< 0.15.23`	`0.16.60.15.23`

概要

Impact

Various forms of SQL injection has been found, for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL was only affected when filtering with contains, starts_with or ends_with filters (and their case-insensitive counterparts)

Patches

Please upgrade to 0.15.23+ or 0.16.6+

For more information

If you have any questions or comments about this advisory:

Open an issue in Github
Chat to us on Gitter

NVD の説明

In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of SQL injection have been found for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL are only affected when filtering with contains, starts_with, or ends_with filters (and their case-insensitive counterparts).