CVE-2022-34265

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.

Database specific

{
    "cna_assigner": "mitre",
    "unresolved_ranges": [
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "3.2"
                },
                {
                    "fixed": "3.2.14"
                },
                {
                    "introduced": "4.0"
                },
                {
                    "fixed": "4.0.6"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/34xxx/CVE-2022-34265.json"
}

References

Affected packages

Git / github.com/django/django

Affected ranges

Type

GIT

Repo

https://github.com/django/django

Events

Introduced

3591e1c1acbd7c13174275367c3fdf012cb0413b

Fixed

746e88cc634469112b823225c19d75c7362f8ecf

Introduced

ef62a3a68c9d558486145a42c0d71ea9a76add9e

Fixed

caad462feaa84ba78ed658a9595a4a4363dad2db

Database specific

{
    "cpe": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "3.2"
        },
        {
            "fixed": "3.2.14"
        },
        {
            "introduced": "4.0"
        },
        {
            "fixed": "4.0.6"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-34265.json"