CVE-2022-28347: SQL Injection
QuerySet.explain() method was subject to SQL injection in option names, using a suitably crafted dictionary, with dictionary expansion, as the options argument.
This issue has High severity, according to the Django security policy [1].
Other sources
A flaw was found in the Django package, leading to a SQL injection. This flaw allows an attacker using a crafted dictionary containing malicious SQL queries to compromise the database completely.
A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the options argument, and placing the injection payload in an option name.
— GitHub
A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the options argument, and placing the injection payload in an option name.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/automation-controllerto a version that resolves this vulnerability.Fixed in 0:4.1.2-2.el8a - Upgrade
Upgrade
redhat/python-djangoto a version that resolves this vulnerability.Fixed in 0:3.2.13-1.el8 - Upgrade
Upgrade
redhat/python3-djangoto a version that resolves this vulnerability.Fixed in 0:2.2.28-1.el7 - Upgrade
Upgrade
redhat/python3-djangoto a version that resolves this vulnerability.Fixed in 0:2.2.28-1.el8 - Upgrade
Upgrade
redhat/python-djangoto a version that resolves this vulnerability.Fixed in 0:3.2.13-2.el8 - Upgrade
Upgrade
redhat/python-pulpcoreto a version that resolves this vulnerability.Fixed in 0:3.17.6-3.el8 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.0.4 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 3.2.13 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 2.2.28 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 4.0.4 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 3.2.13 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 2.2.28 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 3.2.13-r0 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 2:3.2.13-1 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.25-0+deb12u3Fixed in 3:3.2.25-0+deb12u6Fixed in 3:4.2.28-0+deb13u2Fixed in 3:4.2.28-0+deb13u1Fixed in 3:5.2.17-2Fixed in 3:5.2.19-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-28347?
CVE-2022-28347 is a SQL injection vulnerability in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.
How severe is CVE-2022-28347?
CVE-2022-28347 has a severity rating of 9.8 (Critical).
Which versions of Django are affected by CVE-2022-28347?
Django versions 2.2 to 2.2.28, 3.2 to 3.2.13, and 4.0 to 4.0.4 are affected by CVE-2022-28347.
How can I fix CVE-2022-28347?
To fix CVE-2022-28347, update Django to version 2.2.28, 3.2.13, or 4.0.4.
Where can I find more information about CVE-2022-28347?
You can find more information about CVE-2022-28347 at the following sources: [CVE website](https://www.cve.org/CVERecord?id=CVE-2022-28347), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-28347), [Django security releases](https://www.djangoproject.com/weblog/2022/apr/11/security-releases/), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=2072459), and [Red Hat Advisory](https://access.redhat.com/errata/RHSA-2022:5702).