PYSEC-2022-190
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/django/PYSEC-2022-190.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2022-190
- Aliases
- Published
- 2022-04-12T05:15:00Z
- Modified
- 2023-12-06T00:47:09.506926Z
- Summary
- [none]
- Details
-
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
- References
-
- http://www.openwall.com/lists/oss-security/2022/04/11/1
- https://docs.djangoproject.com/en/4.0/releases/security/
- https://www.djangoproject.com/weblog/2022/apr/11/security-releases/
- https://groups.google.com/forum/#!forum/django-announce
- https://lists.debian.org/debian-lts-announce/2022/04/msg00013.html
- https://github.com/advisories/GHSA-2gwj-7jmv-h26r
Affected packages
PyPI / django
Package
- Name
- django
- View open source insights on deps.dev
- Purl
- pkg:pypi/django
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced4.0Fixed4.0.4Introduced3.2Fixed3.2.13Introduced2.2Fixed2.2.28
Affected versions
2.*
2.2
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.20
2.2.21
2.2.22
2.2.23
2.2.24
2.2.25
2.2.26
2.2.27
3.*
3.2
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.8
3.2.9
3.2.10
3.2.11
3.2.12
4.*
4.0
4.0.1
4.0.2
4.0.3