CVE-2022-28346

Advisory

Django 2.2.28, 3.2.13 and 4.0.4 include a fix for CVE-2022-28346: An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
https://www.djangoproject.com/weblog/2022/apr/11/security-releases

Affected package

Affected versions

Fixed versions

Vulnerability changelog

===========================

*April 11, 2022*

Django 2.2.28 fixes two security issues with severity "high" in 2.2.27.

CVE-2022-28346: Potential SQL injection in ``QuerySet.annotate()``, ``aggregate()``, and ``extra()``
====================================================================================================

:meth:`.QuerySet.annotate`, :meth:`~.QuerySet.aggregate`, and
:meth:`~.QuerySet.extra` methods were subject to SQL injection in column
aliases, using a suitably crafted dictionary, with dictionary expansion, as the
``**kwargs`` passed to these methods.

CVE-2022-28347: Potential SQL injection via ``QuerySet.explain(**options)`` on PostgreSQL
=========================================================================================

:meth:`.QuerySet.explain` method was subject to SQL injection in option names,
using a suitably crafted dictionary, with dictionary expansion, as the
``**options`` argument.


===========================

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28346
• http://www.openwall.com/lists/oss-security/2022/04/11/1
• https://docs.djangoproject.com/en/4.0/releases/security/
• https://www.djangoproject.com/weblog/2022/apr/11/security-releases/
• https://groups.google.com/forum/#!forum/django-announce
• https://lists.debian.org/debian-lts-announce/2022/04/msg00013.html
• https://security.netapp.com/advisory/ntap-20220609-0002/
• https://www.debian.org/security/2022/dsa-5254