CVE-2022-28346
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods ar...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
django
[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.2.28"},{"introduced":"3.2.0"},{"fixed":"3.2.13"},{"introduced":"4.0.0"},{"fixed":"4.0.4"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2022-28346 python-django 修正版: 2:2.2.28-1~deb11u1
参照URL
- advisory openwall.com
- advisory docs.djangoproject.com
- advisory lists.debian.org
- advisory security.netapp.com
- advisory debian.org
- advisory djangoproject.com
- web groups.google.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web nvd.nist.gov