{
  "cveId": "CVE-2024-53908",
  "url": "https://patchblox.com/security/cve/CVE-2024-53908",
  "summary": "CVE-2024-53908 is fixed in 3 products on 1 platform, first by python3-django 3:4.2.11-1ubuntu1.4, released December 4, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "python3-django: An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and4.2 before 4.2.17",
  "description": "An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKeylookup, when an Oracle database is used, is subject to SQL injection ifuntrusted data is used as an lhs value. (Applications that use thejsonfield.has_key lookup via __ are unaffected.)",
  "published": "2024-12-04T07:00:00Z",
  "severity": "Medium",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.01415,
  "epssPercentile": 0.72923,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "4.2.11-150600.3.12.1",
      "fix": "SUSE-SU-2024:4285-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4285-1",
      "released": "2024-12-11T08:30:20Z"
    },
    {
      "platform": "linux",
      "product": "python-Django",
      "release": "sles 15.6",
      "fixedVersion": "4.2.11-150600.3.12.1",
      "fix": "SUSE-SU-2024:4285-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-4285-1",
      "released": "2024-12-11T08:30:20Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3:4.2.17-1",
      "fix": "DEBIAN-CVE-2024-53908",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-53908",
      "released": "2024-12-06T12:15:18Z"
    },
    {
      "platform": "linux",
      "product": "python-django",
      "release": "Debian 14",
      "fixedVersion": "3:4.2.17-1",
      "fix": "DEBIAN-CVE-2024-53908",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-53908",
      "released": "2024-12-06T12:15:18Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "3:4.2.11-1ubuntu1.4",
      "fix": "python3-django 3:4.2.11-1ubuntu1.4",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-django-3-4.2.11-1ubuntu1.4",
      "released": "2024-12-04T07:00:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-django",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "3:4.2.15-1ubuntu1.1",
      "fix": "python3-django 3:4.2.15-1ubuntu1.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-python3-django-3-4.2.15-1ubuntu1.1",
      "released": "2026-01-16T01:42:23Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T13:31:49Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}