GHSA-p64x-8rxx-wf6q

Source

https://github.com/advisories/GHSA-p64x-8rxx-wf6q

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-p64x-8rxx-wf6q/GHSA-p64x-8rxx-wf6q.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-p64x-8rxx-wf6q

Aliases

Published

2022-07-05T00:00:53Z

Modified

2024-09-20T16:07:41.522098Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection

Details

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.

Database specific

{
    "nvd_published_at": "2022-07-04T16:15:00Z",
    "cwe_ids": [
        "CWE-89"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-05T21:08:03Z"
}

References

Affected packages

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.2a1

Fixed

3.2.14

Affected versions

3.*

3.2a1

3.2b1

3.2rc1

3.2

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

3.2.6

3.2.7

3.2.8

3.2.9

3.2.10

3.2.11

3.2.12

3.2.13

Ecosystem specific

{
    "affected_functions": [
        "django.db.models.functions.Trunc",
        "django.db.models.functions.Extract"
    ]
}

PyPI / django

Package

Name: django; View open source insights on deps.dev
Purl: pkg:pypi/django

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0a1

Fixed

4.0.6

Affected versions

4.*

4.0a1

4.0b1

4.0rc1

4.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

Ecosystem specific

{
    "affected_functions": [
        "django.db.models.functions.Trunc",
        "django.db.models.functions.Extract"
    ]
}