ArchLinux: 202204-9: python-django: sql injection | LinuxSecurity.com
Arch Linux Security Advisory ASA-202204-9
=========================================

Severity: High
Date    : 2022-04-12
CVE-ID  : CVE-2022-28346 CVE-2022-28347
Package : python-django
Type    : sql injection
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2667

Summary
=======

The package python-django before version 4.0.4-1 is vulnerable to sql
injection.

Resolution
==========

Upgrade to 4.0.4-1.

# pacman -Syu "python-django>=4.0.4-1"

The problems have been fixed upstream in version 4.0.4.

Workaround
==========

None.

Description
===========

- CVE-2022-28346 (sql injection)

QuerySet.annotate(), aggregate(), and extra() methods were subject to
SQL injection in column aliases, using a suitably crafted dictionary,
with dictionary expansion, as the **kwargs passed to these methods.

- CVE-2022-28347 (sql injection)

QuerySet.explain() method was subject to SQL injection in option names,
using a suitably crafted dictionary, with dictionary expansion, as the
**options argument.

Impact
======

An attacker is able to perform an SQL injection via a specially crafted
input.

References
==========

https://www.djangoproject.com/weblog/2022/apr/11/security-releases/
https://github.com/django/django/commit/93cae5cb2f9a4ef1514cf1a41f714fef08005200
https://github.com/django/django/commit/800828887a0509ad1162d6d407e94d8de7eafc60
https://github.com/django/django/commit/2044dac5c6968441be6f534c4139bcf48c5c7e48
https://github.com/django/django/commit/2c09e68ec911919360d5f8502cefc312f9e03c5d
https://github.com/django/django/commit/6723a26e59b0b5429a0c5873941e01a2e1bdbb81
https://github.com/django/django/commit/00b0fc50e1738c7174c495464a5ef069408a4402
https://github.com/django/django/commit/9e19accb6e0a00ba77d5a95a91675bf18877c72d
https://github.com/django/django/commit/29a6c98b4c13af82064f993f0acc6e8fafa4d3f5
https://security.archlinux.org/CVE-2022-28346
https://security.archlinux.org/CVE-2022-28347

ArchLinux: 202204-9: python-django: sql injection

April 12, 2022
The package python-django before version 4.0.4-1 is vulnerable to sql injection

Summary

- CVE-2022-28346 (sql injection)
QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods.
- CVE-2022-28347 (sql injection)
QuerySet.explain() method was subject to SQL injection in option names, using a suitably crafted dictionary, with dictionary expansion, as the **options argument.

Resolution

Upgrade to 4.0.4-1.
# pacman -Syu "python-django>=4.0.4-1"
The problems have been fixed upstream in version 4.0.4.

References

https://www.djangoproject.com/weblog/2022/apr/11/security-releases/ https://github.com/django/django/commit/93cae5cb2f9a4ef1514cf1a41f714fef08005200 https://github.com/django/django/commit/800828887a0509ad1162d6d407e94d8de7eafc60 https://github.com/django/django/commit/2044dac5c6968441be6f534c4139bcf48c5c7e48 https://github.com/django/django/commit/2c09e68ec911919360d5f8502cefc312f9e03c5d https://github.com/django/django/commit/6723a26e59b0b5429a0c5873941e01a2e1bdbb81 https://github.com/django/django/commit/00b0fc50e1738c7174c495464a5ef069408a4402 https://github.com/django/django/commit/9e19accb6e0a00ba77d5a95a91675bf18877c72d https://github.com/django/django/commit/29a6c98b4c13af82064f993f0acc6e8fafa4d3f5 https://security.archlinux.org/CVE-2022-28346 https://security.archlinux.org/CVE-2022-28347

Severity
CVE-ID : CVE-2022-28346 CVE-2022-28347
Package : python-django
Type : sql injection
Remote : Yes
Link : https://security.archlinux.org/AVG-2667

Impact

An attacker is able to perform an SQL injection via a specially crafted input.

Workaround

None.

Related News

Test AD

319
© 2022 Guardian Digital, Inc All Rights Reserved

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.