CVE-2020-11010 – In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of SQL

In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of SQL injection have been found for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL are only affected when filtering with contains, starts_with, or ends_with filters (and their case-insensitive counterparts).

 

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11010

Reference (s):

• https://github.com/tortoise/tortoise-orm/security/advisories/GHSA-9j2c-x8qm-qmjq
• https://github.com/tortoise/tortoise-orm/commit/91c364053e0ddf77edc5442914c6f049512678b3