CVE-2019-14234

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.

• CWE-89

• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlMailing List, Third Party Advisory
• https://docs.djangoproject.com/en/dev/releases/security/Vendor Advisory
• https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/
• https://seclists.org/bugtraq/2019/Aug/15Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202004-17
• https://security.netapp.com/advisory/ntap-20190828-0002/
• https://www.debian.org/security/2019/dsa-4498Third Party Advisory
• https://www.djangoproject.com/weblog/2019/aug/01/security-releases/Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.htmlMailing List, Third Party Advisory
• https://docs.djangoproject.com/en/dev/releases/security/Vendor Advisory
• https://groups.google.com/forum/#%21topic/django-announce/jIoju2-KLDs
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STVX7X7IDWAH5SKE6MBMY3TEI6ZODBTK/
• https://seclists.org/bugtraq/2019/Aug/15Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202004-17
• https://security.netapp.com/advisory/ntap-20190828-0002/
• https://www.debian.org/security/2019/dsa-4498Third Party Advisory
• https://www.djangoproject.com/weblog/2019/aug/01/security-releases/Vendor Advisory

Published

Aug 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14228Xavier PHP Management Panel 3.0 is vulnerable to Reflected P…
• CVE-2019-1423An elevation of privilege vulnerability exists in the way th…7.8
• CVE-2019-14230An issue was discovered in the Viral Quiz Maker - OnionBuzz …
• CVE-2019-14231An issue was discovered in the Viral Quiz Maker - OnionBuzz …
• CVE-2019-14232An issue was discovered in Django 1.11.x before 1.11.23, 2.1…7.5
• CVE-2019-14233An issue was discovered in Django 1.11.x before 1.11.23, 2.1…
• CVE-2019-14235An issue was discovered in Django 1.11.x before 1.11.23, 2.1…
• CVE-2019-14236On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, ST…9.8
• CVE-2019-14237On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, …9.8
• CVE-2019-14238On STMicroelectronics STM32F7 devices, Proprietary Code Read…6.6
• CVE-2019-14239On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, …6.6
• CVE-2019-1424A security feature bypass vulnerability exists when Windows …8.1