Bug 2400449 (CVE-2025-59681)

Summary:	CVE-2025-59681 django: Potential SQL injection in QuerySet.annotate(), alias(), aggregate(), and extra() on MySQL and MariaDB1
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	anthomas, brasmith, caswilli, cochase, dnakabaa, dranck, eglynn, ehelms, ggainey, haoli, hkataria, jajackso, jcammara, jjoyce, jmitchel, jneedle, joehler, jschluet, juwatts, jwong, kaycoth, kegrant, koliveir, kshier, lbrazdil, lcouzens, lhh, lsvaty, mabashia, mburns, mgarciac, mhulan, mminar, mskarbek, nmoumoul, osousa, pbraun, pcreech, pgrist, rbiba, rchan, security-response-team, shvarugh, simaishi, smallamp, smcdonal, sskracic, stcannon, teagle, tfister, thavo, tmalecek, tpfromme, ttakamiy, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Django. A couple of QuerySet methods are subject to SQL injection in column aliases, using a suitably crafted dictionary.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2416112, 2416113, 2416114, 2416115, 2416116, 2416117, 2416118
Bug Blocks:
Deadline:	2025-10-01

Description OSIDB Bzimport 2025-09-30 13:17:50 UTC

QuerySet.annotate(), QuerySet.alias(), QuerySet.aggregate(), andQuerySet.extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods on MySQL and MariaDB.

Comment 1 errata-xmlrpc 2025-10-22 16:41:35 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 8
  Red Hat Ansible Automation Platform 2.5 for RHEL 9

Via RHSA-2025:18984 https://access.redhat.com/errata/RHSA-2025:18984