Vulnerability advisory
CVE-2022-28346
Also known as BIT-django-2022-28346GHSA-2gwj-7jmv-h26rPYSEC-2022-190
Severity
Severity not reported.
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/django/django ↗ | |
| 2a62cdcfec85938f40abb2e9e6a9ff497e02afe8 to before 5c3300027b30c1b498d99010f7d618316f685045 | 5c3300027b30c1b498d99010f7d618316f685045 |
| 3591e1c1acbd7c13174275367c3fdf012cb0413b to before 08e6073f878264a0c091da0d3db456820252ef6c | 08e6073f878264a0c091da0d3db456820252ef6c |
| ef62a3a68c9d558486145a42c0d71ea9a76add9e to before 89807fbde8b7b17d00434bc4695535855e96fe77 | 89807fbde8b7b17d00434bc4695535855e96fe77 |
Description
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
References
- Webwww.openwall.com/lists/oss-security/2022/04/11/1 ↗
- Webdocs.djangoproject.com/en/4.0/releases/security/ ↗
- Webgroups.google.com/forum/#%21forum/django-announce ↗
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28346.json ↗
- Advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/ ↗
- Advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/ ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2022-28346 ↗
- Advisorysecurity.netapp.com/advisory/ntap-20220609-0002/ ↗
- Advisorywww.debian.org/security/2022/dsa-5254 ↗
- ARTICLElists.debian.org/debian-lts-announce/2022/04/msg00013.html ↗
- ARTICLEwww.djangoproject.com/weblog/2022/apr/11/security-releases/ ↗