Lucene search

PRIOn knowledge basePRION:CVE-2022-28346

HistoryApr 12, 2022 - 5:15 a.m.

Sql injection

2022-04-1205:15:00

PRIOn knowledge base

www.prio-n.com

9.4 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

69.5%

JSON

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.

CPENameOperatorVersion
debian_linuxeq9.0
debian_linuxeq11.0
djangoge4.0
djangolt4.0.4
djangoge3.2
djangolt3.2.13
djangoge2.2
djangolt2.2.28

Name	Operator	Version
debian_linux	eq	9.0
debian_linux	eq	11.0
django	ge	4.0
django	lt	4.0.4
django	ge	3.2
django	lt	3.2.13
django	ge	2.2
django	lt	2.2.28

References

www.openwall.com/lists/oss-security/2022/04/11/1

docs.djangoproject.com/en/4.0/releases/security/

groups.google.com/forum/

lists.debian.org/debian-lts-announce/2022/04/msg00013.html

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/

security.netapp.com/advisory/ntap-20220609-0002/

www.debian.org/security/2022/dsa-5254

www.djangoproject.com/weblog/2022/apr/11/security-releases/