Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Mageia 8: 2022-0190 Moderate: Python-Django SQL Injection Issues

mageia
Calendar Grey May 19, 2022
Dist Mageia Esm H88
Critical patch released for python-django packages to resolve SQL injection threats in Mageia. Detailed update information is included.
Potential SQL injection in QuerySet.annotate(), aggregate(), and extra() (CVE-2022-28346) Potential SQL injection via QuerySet.explain(**options) on PostgreSQL QuerySet.explain() (...

Summary

Potential SQL injection in QuerySet.annotate(), aggregate(), and extra() (CVE-2022-28346) Potential SQL injection via QuerySet.explain(**options) on PostgreSQL QuerySet.explain() (CVE-2022-28347)

References

- https://bugs.mageia.org/show_bug.cgi?id=30273

- https://www.djangoproject.com/weblog/2022/apr/11/security-releases/

- https://ubuntu.com/security/notices/USN-5373-1

- https://www.cve.org/CVERecord?id=CVE-2022-28346

- https://www.cve.org/CVERecord?id=CVE-2022-28347

Topics%20covered

Topics Covered

security advisory update security fix sql injection python-django mageia

Resolution

SRPMS

- 8/core/python-django-3.2.13-1.mga8

Publication date: 19 May 2022
URL: https://advisories.mageia.org/MGASA-2022-0190.html
Type: security
CVE: CVE-2022-28346, CVE-2022-28347

Topics%20covered

Topics Covered

security advisory update security fix sql injection python-django mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here