CVE-2022-34265
2 advisories.
PyPI/django CVE-2022-34265: critical 9.8
Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection
Action: Upgrade django to 3.2.14 or later.
pip install django==3.2.14pip install django==4.0.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.2a1 | 3.2.14 | - |
| 4.0a1 | 4.0.6 | - |
Fixed versions
| 3.2.14 | 4.0.6 |
Sources
- osv: GHSA-p64x-8rxx-wf6q
- https://nvd.nist.gov/vuln/detail/CVE-2022-34265
- https://github.com/django/django/commit/0dc9c016fadb71a067e5a42be30164e3f96c0492
- https://github.com/django/django/commit/5e2f4ddf2940704a26a4ac782b851989668d74db
- https://github.com/django/django/commit/877c800f255ccaa7abde1fb944de45d1616f5cc9
- https://github.com/django/django/commit/a9010fe5555e6086a9d9ae50069579400ef0685e
- https://docs.djangoproject.com/en/4.0/releases/security
- https://github.com/advisories/GHSA-p64x-8rxx-wf6q
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-213.yaml
- https://groups.google.com/forum/#!forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
- https://security.netapp.com/advisory/ntap-20220818-0006
- https://www.debian.org/security/2022/dsa-5254
- https://www.djangoproject.com/weblog/2022/jul/04/security-releases
CVE-2022-34265 · published · modified · JSON
PyPI/django CVE-2022-34265: unknown
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name valu
Action: Upgrade django to 3.2.14 or later.
pip install django==3.2.14pip install django==4.0.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.2 | 3.2.14 | - |
| 4.0 | 4.0.6 | - |
Fixed versions
| 3.2.14 | 4.0.6 |
Sources
- osv: PYSEC-2022-213
- https://www.djangoproject.com/weblog/2022/jul/04/security-releases/
- https://docs.djangoproject.com/en/4.0/releases/security/
- https://groups.google.com/forum/#!forum/django-announce
- https://github.com/advisories/GHSA-p64x-8rxx-wf6q
CVE-2022-34265 · published · modified · JSON