CVE-2020-11010

Advisory

Tortoise-orm versions 0.15.23 and 0.16.6 include a fix for CVE-2020-11010: In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of SQL injection have been found for MySQL and when filtering or doing mass-updates on char/text fields. SQLite and PostgreSQL are only affected when filtering with contains, starts_with, or ends_with filters (and their case-insensitive counterparts).
https://github.com/tortoise/tortoise-orm/commit/91c364053e0ddf77edc5442914c6f049512678b3
https://github.com/tortoise/tortoise-orm/security/advisories/GHSA-9j2c-x8qm-qmjq

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-------
- Fixed SQL injection issue in MySQL
- Fixed SQL injection issues in MySQL when using ``contains``, ``starts_with`` or ``ends_with`` filters (and their case-insensitive counterparts)
- Fixed malformed SQL for PostgreSQL and SQLite when using ``contains``, ``starts_with`` or ``ends_with`` filters (and their case-insensitive counterparts)

Resources

• https://pypi.org/project/tortoise-orm
• https://pyup.io/changelogs/tortoise-orm/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11010
• https://github.com/tortoise/tortoise-orm/security/advisories/GHSA-9j2c-x8qm-qmjq
• https://github.com/tortoise/tortoise-orm/commit/91c364053e0ddf77edc5442914c6f049512678b3