PT-2020-12490 · Tortoise · Tortoise Orm

Grigipublished · Published 2020-04-20 · Updated 2020-04-28 · CVE-2020-11010

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tortoise ORM versions prior to 0.15.23 Tortoise ORM versions prior to 0.16.6

Description The issue affects Tortoise ORM, where various forms of SQL injection have been found for MySQL when filtering or doing mass-updates on char/text fields. SQLite and PostgreSQL are only affected when filtering with contains, starts with, or ends with filters (and their case-insensitive counterparts).

Recommendations For Tortoise ORM versions prior to 0.15.23, please upgrade to 0.15.23 or later. For Tortoise ORM versions prior to 0.16.6, please upgrade to 0.16.6 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-11010

GHSA-9J2C-X8QM-QMJQ

PYSEC-2020-144

Affected Products

Tortoise Orm

References · 9

• https://github.com/tortoise/tortoise-orm/commit/91c364053e0ddf77edc5442914c6f049512678b3 · Patch
• https://osv.dev/vulnerability/CVE-2020-11010 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9j2c-x8qm-qmjq · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-144 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11010 · Security Note
• https://github.com/tortoise/tortoise-orm/security/advisories/GHSA-9j2c-x8qm-qmjq · Note
• https://github.com/tortoise/tortoise-orm · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tortoise-orm/PYSEC-2020-144.yaml · Note
• https://t.me/cvenotify/2946 · Telegram Post