Vulnerability advisory

PYSEC-2022-213

Published Jul 4, 2022Updated Dec 6, 2023OSV record ↗

Also known as BIT-django-2022-34265CVE-2022-34265GHSA-p64x-8rxx-wf6q

Severity

Severity not reported.

Affected versions

django PyPI

Affected	Fixed in
`3.2` to before 3.2.14	`3.2.14`Advisories →
`4.0` to before 4.0.6	`4.0.6`Advisories →
Also listed as affected (20) `3.2` `3.2.1` `3.2.10` `3.2.11` `3.2.12` `3.2.13` `3.2.2` `3.2.3` `3.2.4` `3.2.5` `3.2.6` `3.2.7` `3.2.8` `3.2.9` `4.0` `4.0.1` `4.0.2` `4.0.3` `4.0.4` `4.0.5`

Description

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.

References

ARTICLEwww.djangoproject.com/weblog/2022/jul/04/security-releases/ ↗
Webdocs.djangoproject.com/en/4.0/releases/security/ ↗
Webgroups.google.com/forum/#!forum/django-announce ↗
Advisorygithub.com/advisories/GHSA-p64x-8rxx-wf6q ↗