CVE-2022-34265

CRITICAL severity · CVSS 9.8 · SQL injection

9.8CVSS CRITICAL

Summary

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)93%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

Django

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: https://docs.djangoproject.com/en/4.0/releases/security/ ↗

Additional information

NVD record
https://docs.djangoproject.com/en/4.0/releases/security/Patch
https://www.djangoproject.com/weblog/2022/jul/04/security-releases/Patch
https://docs.djangoproject.com/en/4.0/releases/security/Patch
https://groups.google.com/forum/#%21forum/django-announce
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
https://security.netapp.com/advisory/ntap-20220818-0006/Advisory
https://www.debian.org/security/2022/dsa-5254Advisory