CVE-2022-34265

CRITICAL9.8EPSS 92.8%

Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection

發布日:2022/7/5修改日:2025/4/3

也稱為:GHSA-p64x-8rxx-wf6qBIT-django-2022-34265PYSEC-2022-213

描述

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.

受影響套件(4)

Bitnami/django>= 3.2.0, < 3.2.14, >= 4.0.0, < 4.0.6
Debian/python-djangofrom 0, < 2:2.2.28-1~deb11u1
PyPI/django>= 3.2a1, < 3.2.14
PyPI/django>= 3.2, < 3.2.14, >= 4.0, < 4.0.6

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(22)

ADVISORYhttps://github.com/advisories/GHSA-p64x-8rxx-wf6q
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-34265
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2022-34265
ADVISORYhttps://www.djangoproject.com/weblog/2022/jul/04/security-releases/
PATCHhttps://github.com/django/django
WEBhttps://docs.djangoproject.com/en/4.0/releases/security
WEBhttps://docs.djangoproject.com/en/4.0/releases/security/
WEBhttps://github.com/django/django/commit/0dc9c016fadb71a067e5a42be30164e3f96c0492
WEBhttps://github.com/django/django/commit/5e2f4ddf2940704a26a4ac782b851989668d74db
WEBhttps://github.com/django/django/commit/877c800f255ccaa7abde1fb944de45d1616f5cc9
WEBhttps://github.com/django/django/commit/a9010fe5555e6086a9d9ae50069579400ef0685e
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-213.yaml
WEBhttps://groups.google.com/forum/#%21forum/django-announce
WEBhttps://groups.google.com/forum/#!forum/django-announce
WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
WEBhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
WEBhttps://security.netapp.com/advisory/ntap-20220818-0006
WEBhttps://security.netapp.com/advisory/ntap-20220818-0006/
WEBhttps://www.debian.org/security/2022/dsa-5254
WEBhttps://www.djangoproject.com/weblog/2022/jul/04/security-releases