tocsin

CVE-2022-28346

2 advisories.

PyPI/django CVE-2022-28346: critical 9.8

SQL Injection in Django

Action: Upgrade django to 2.2.28 or later.

pip install django==2.2.28
pip install django==3.2.13
pip install django==4.0.4

Affected

introducedfixedlast affected
2.22.2.28-
3.23.2.13-
4.04.0.4-

Fixed versions

2.2.283.2.134.0.4

Sources

CVE-2022-28346 · published · modified · JSON

PyPI/django CVE-2022-28346: unknown

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a

Action: Upgrade django to 2.2.28 or later.

pip install django==4.0.4
pip install django==3.2.13
pip install django==2.2.28

Affected

introducedfixedlast affected
2.22.2.28-
3.23.2.13-
4.04.0.4-

Fixed versions

4.0.43.2.132.2.28

Sources

CVE-2022-28346 · published · modified · JSON