Lucene search
GoogleOSV:PYSEC-2022-190HistoryApr 12, 2022 - 5:15 a.m.
PYSEC-2022-190
2022-04-1205:15:00
Google
osv.dev
60
0.003 Low
EPSS
Percentile
69.5%
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
References
www.openwall.com/lists/oss-security/2022/04/11/1
docs.djangoproject.com/en/4.0/releases/security/
github.com/advisories/GHSA-2gwj-7jmv-h26r
groups.google.com/forum/#!forum/django-announce
lists.debian.org/debian-lts-announce/2022/04/msg00013.html
www.djangoproject.com/weblog/2022/apr/11/security-releases/
Related
githubexploit
githubexploit
Exploit for SQL Injection in Djangoproject Django
2022-05-15 00:24:19
Exploit for SQL Injection in Djangoproject Django
2024-01-19 00:15:59
Exploit for SQL Injection in Djangoproject Django
2022-04-26 14:47:56
cvelist
cvelist
CVE-2022-28346
2022-04-12 00:00:00
osv
osv
SQL Injection in Django
2022-04-13 00:00:33
python-django - security update
2022-04-14 00:00:00
CVE-2022-28346
2022-04-12 05:15:06
openvas
openvas
Debian: Security Advisory (DLA-2982-1)
2022-04-15 00:00:00
Ubuntu: Security Advisory (USN-5373-2)
2022-08-26 00:00:00
nvd
nvd
CVE-2022-28346
2022-04-12 05:15:06
github
github
SQL Injection in Django
2022-04-13 00:00:33
nessus
nessus
Debian DLA-2982-1 : python-django - LTS security update
2022-04-14 00:00:00
RHEL 8 : RHUI 4.1.1 - Security Fixes and Enhancement Update (Important) (RHSA-2022:5602)
2024-04-28 00:00:00
RHEL 7 / 8 : Red Hat Ansible Automation Platform 1.2 (RHSA-2022:5703)
2024-04-28 00:00:00
redhatcve
redhatcve
CVE-2022-28346
2022-04-11 12:50:13
veracode
veracode
SQL Injection
2022-04-13 09:11:04
cve
cve
CVE-2022-28346
2022-04-12 05:15:06
debian
debian
[SECURITY] [DLA 2982-1] python-django security update
2022-04-14 15:45:49
[SECURITY] [] python-django security update
2022-11-04 14:35:57
[SECURITY] [] python-django security update
2022-11-04 14:36:21
redhat
redhat
prion
prion
Sql injection
2022-04-12 05:15:00
alpinelinux
alpinelinux
CVE-2022-28346
2022-04-12 05:15:06
ubuntucve
ubuntucve
CVE-2022-28346
2022-04-11 00:00:00
debiancve
debiancve
CVE-2022-28346
2022-04-12 05:15:06
ubuntu
ubuntu
Django vulnerabilities
2022-04-11 00:00:00
Django vulnerabilities
2022-04-11 00:00:00
archlinux
archlinux
[ASA-202204-9] python-django: sql injection
2022-04-12 00:00:00
altlinux
altlinux
redos
redos
ROS-20220516-04
2022-05-16 00:00:00
mageia
mageia
Updated python-django packages fix security vulnerability
2022-05-19 10:56:04
freebsd
freebsd
Django -- multiple vulnerabilities
2022-04-02 00:00:00
fedora
fedora
[SECURITY] Fedora 37 Update: python-django-4.0.10-1.fc37
2023-04-28 02:04:16
[SECURITY] Fedora 38 Update: python-django-4.0.10-1.fc38
2023-04-28 02:37:47
rocky
rocky
Satellite 6.11 Release
2022-07-05 13:55:16