SQL injection in Tortoise ORM

CAO 8.8CVE-2020-11010 · GHSA-9j2c-x8qm-qmjq · PYSEC-2020-144 · Công bố 20/04/2020 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2020-11010 là lỗ hổng mức CAO (CVSS 8.8) ảnh hưởng tortoise-orm, tortoise orm (tortoise orm project).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.1%, cao hơn 64.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.16.6, 0.15.23 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
tortoise-orm PyPI	`≥ 0.16.0, < 0.16.6< 0.15.23`	`0.16.60.15.23`
tortoise orm tortoise_orm_project	`≥ 0.16.0, < 0.16.6< 0.15.23`	`0.16.60.15.23`

Mô tả

Impact

Various forms of SQL injection has been found, for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL was only affected when filtering with contains, starts_with or ends_with filters (and their case-insensitive counterparts)

Patches

Please upgrade to 0.15.23+ or 0.16.6+

For more information

If you have any questions or comments about this advisory:

Open an issue in Github
Chat to us on Gitter

Mô tả của NVD

In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of SQL injection have been found for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL are only affected when filtering with contains, starts_with, or ends_with filters (and their case-insensitive counterparts).