Vulnerability advisory

PYSEC-2022-190

Published Apr 12, 2022Updated Dec 6, 2023OSV record ↗

Also known as BIT-django-2022-28346CVE-2022-28346GHSA-2gwj-7jmv-h26r

Severity

Severity not reported.

Affected versions

django PyPI

Affected	Fixed in
`4.0` to before 4.0.4	`4.0.4`Advisories →
`3.2` to before 3.2.13	`3.2.13`Advisories →
`2.2` to before 2.2.28	`2.2.28`Advisories →
Also listed as affected (45) `2.2` `2.2.1` `2.2.10` `2.2.11` `2.2.12` `2.2.13` `2.2.14` `2.2.15` `2.2.16` `2.2.17` `2.2.18` `2.2.19` `2.2.2` `2.2.20` `2.2.21` `2.2.22` `2.2.23` `2.2.24` `2.2.25` `2.2.26` `2.2.27` `2.2.3` `2.2.4` `2.2.5` `2.2.6` `2.2.7` `2.2.8` `2.2.9` `3.2` `3.2.1` `3.2.10` `3.2.11` `3.2.12` `3.2.2` `3.2.3` `3.2.4` `3.2.5` `3.2.6` `3.2.7` `3.2.8` `3.2.9` `4.0` `4.0.1` `4.0.2` `4.0.3`

Description

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.

PYSEC-2022-190

Affected versions

django PyPI

Description

References