CVE-2022-28346: SQL Injection
QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the kwargs passed to these methods.
This issue has High severity, according to the Django security policy [1].
Other sources
A flaw was found in the Django package, which leads to a SQL injection. This flaw allows an attacker using a crafted dictionary containing malicious SQL queries to compromise the database completely.
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed kwargs.
— GitHub
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed kwargs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/automation-controllerto a version that resolves this vulnerability.Fixed in 0:4.1.2-2.el8a - Upgrade
Upgrade
redhat/python-djangoto a version that resolves this vulnerability.Fixed in 0:3.2.13-1.el8 - Upgrade
Upgrade
redhat/python3-djangoto a version that resolves this vulnerability.Fixed in 0:2.2.28-1.el7 - Upgrade
Upgrade
redhat/python3-djangoto a version that resolves this vulnerability.Fixed in 0:2.2.28-1.el8 - Upgrade
Upgrade
redhat/python-django20to a version that resolves this vulnerability.Fixed in 0:2.0.13-18.el8 - Upgrade
Upgrade
redhat/python-django20to a version that resolves this vulnerability.Fixed in 0:2.0.13-17.el8 - Upgrade
Upgrade
redhat/python-djangoto a version that resolves this vulnerability.Fixed in 0:3.2.13-2.el8 - Upgrade
Upgrade
redhat/python-pulpcoreto a version that resolves this vulnerability.Fixed in 0:3.17.6-3.el8 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.0.4 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 3.2.13 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 2.2.28 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 4.0.4 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 3.2.13 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 2.2.28 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 3.2.13-r0 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 2:3.2.13-1 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.25-0+deb12u3Fixed in 3:3.2.25-0+deb12u6Fixed in 3:4.2.28-0+deb13u2Fixed in 3:4.2.28-0+deb13u1Fixed in 3:5.2.17-2Fixed in 3:5.2.19-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-28346?
CVE-2022-28346 refers to a SQL injection vulnerability in the Django package.
How severe is CVE-2022-28346?
CVE-2022-28346 is considered critical with a severity score of 9.8.
Which versions of Django are affected by CVE-2022-28346?
Django versions 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4 are affected by CVE-2022-28346.
How can I fix CVE-2022-28346?
To fix CVE-2022-28346, update Django to versions 2.2.28, 3.2.13, or 4.0.4 or later.
Where can I find more information about CVE-2022-28346?
You can find more information about CVE-2022-28346 in the official CVE record, NVD database, Django website, Bugzilla, and Red Hat Security Advisories.