CVE-2022-28346
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods ar...
Original description
The description as published by the source.
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
django
[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.2.28"},{"introduced":"3.2.0"},{"fixed":"3.2.13"},{"introduced":"4.0.0"},{"fixed":"4.0.4"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-28346 python-django Fixed in: 2:2.2.28-1~deb11u1
References
- advisory openwall.com
- advisory docs.djangoproject.com
- advisory lists.debian.org
- advisory security.netapp.com
- advisory debian.org
- advisory djangoproject.com
- web groups.google.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web nvd.nist.gov