ASA-202107-11 log generated external raw

[ASA-202107-11] python-django: insufficient validation
Arch Linux Security Advisory ASA-202107-11 ========================================== Severity: High Date : 2021-07-03 CVE-ID : CVE-2021-35042 Package : python-django Type : insufficient validation Remote : Yes Link : Summary ======= The package python-django before version 3.2.5-1 is vulnerable to insufficient validation. Resolution ========== Upgrade to 3.2.5-1. # pacman -Syu "python-django>=3.2.5-1" The problem has been fixed upstream in version 3.2.5. Workaround ========== None. Description =========== A security issue has been found in Django before version 3.2.5. Unsanitized user input passed to QuerySet.order_by() could bypass intended column reference validation in path marked for deprecation resulting in a potential SQL injection even if a deprecation warning is emitted. As a mitigation the strict column reference validation was restored for the duration of the deprecation period. Impact ====== A remote attacker is able to perform a SQL injection via unsanitized user input passed to QuerySet.order_by(). References ==========