CVE-2022-28347
A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passin...
Original description
The description as published by the source.
A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
django
[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.2.28"},{"introduced":"3.2.0"},{"fixed":"3.2.13"},{"introduced":"4.0.0"},{"fixed":"4.0.4"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-28347 python-django Fixed in: 2:2.2.28-1~deb11u1
References
- advisory openwall.com
- advisory docs.djangoproject.com
- advisory debian.org
- advisory djangoproject.com
- web groups.google.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web nvd.nist.gov