CVE-2022-34265
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
django
[{"type":"SEMVER","events":[{"introduced":"3.2.0"},{"fixed":"3.2.14"},{"introduced":"4.0.0"},{"fixed":"4.0.6"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-34265 python-django Corrigé dans: 2:2.2.28-1~deb11u1
Références
- advisory docs.djangoproject.com
- advisory security.netapp.com
- advisory debian.org
- advisory djangoproject.com
- web groups.google.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web nvd.nist.gov