CVE-2020-11010: SQL injection in Tortoise ORM
Summary
CVE-2020-11010: SQL injection in Tortoise ORM. Affects tortoise-orm across 2 version ranges.
< 0.15.23
>= 0.16.0, < 0.16.6
Fixed in 0.15.23 or 0.16.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Tortoise ORM is an open-source Python library that provides an easy-to-use and intuitive interface for interacting with databases. It allows developers to write database queries using Python code, abstracting away the complexities of SQL. However, a vulnerability has been discovered in Tortoise ORM that allows for various forms of SQL injection. This vulnerability affects MySQL when filtering or performing mass-updates on char/text fields. Additionally, SQLite and PostgreSQL are affected when filtering with certain filters such as 'contains', 'starts_with', or 'ends_with'. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.3.
Vulnerability Detail
The SQL injection vulnerability in Tortoise ORM allows an attacker to manipulate database queries by injecting malicious SQL code. This can lead to unauthorized access, data leakage, data manipulation, or even complete compromise of the database. The vulnerability affects different databases in different scenarios, with MySQL being the most affected. For MySQL, the vulnerability occurs when filtering or performing mass-updates on char/text fields. For SQLite and PostgreSQL, the vulnerability is limited to specific filters. The CWE ID associated with this vulnerability is CWE-89.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 0.15.230.15.23pip install --upgrade "tortoise-orm==0.15.23" -
>= 0.16.0, < 0.16.60.16.6pip install --upgrade "tortoise-orm==0.16.6"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, developers can follow general best practices to mitigate the risk of SQL injection. This includes using parameterized queries or prepared statements instead of concatenating user input directly into SQL queries. Additionally, input validation and proper sanitization of user input can help prevent SQL injection attacks.
Conclusion
The SQL injection vulnerability in Tortoise ORM poses a moderate risk to applications utilizing this library. It is crucial for developers to upgrade to the recommended versions of Tortoise ORM to ensure their applications are protected against this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tortoise-orm →
FAQ
Tortoise ORM is an open-source Python library that provides an easy-to-use interface for interacting with databases using Python code. It abstracts away the complexities of SQL and allows developers to write database queries in a more intuitive manner.
SQL injection is a type of vulnerability that allows an attacker to manipulate database queries by injecting malicious SQL code. This can lead to unauthorized access, data leakage, or data manipulation.
The SQL injection vulnerability in Tortoise ORM primarily affects MySQL when filtering or performing mass-updates on char/text fields. SQLite and PostgreSQL are also affected, but only when using specific filters such as 'contains', 'starts_with', or 'ends_with'.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.3.
To fix this vulnerability, it is recommended to upgrade to Tortoise ORM version 0.15.23 or higher for the 0.x.x series, or version 0.16.6 or higher for the 0.16.x series. Upgrading to these versions will include the necessary patches to mitigate the SQL injection vulnerability.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
