CVE-2022-34265: SQL Injection
A flaw was found in Django. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value.
Other sources
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
— GitHub
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
In Django versions 4.0, 4.1 (beta), and 3.2, Trunc() and Extract() database functions were subject to SQL injection if untrusted data was used as a lookupname/kind value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-34265?
CVE-2022-34265 is a vulnerability in Django 3.2 before 3.2.14 and 4.0 before 4.0.6 that allows for SQL injection if untrusted data is used as a kind/lookup_name value in the Trunc() and Extract() database functions.
What is the severity of CVE-2022-34265?
CVE-2022-34265 has a severity rating of 9.8 (Critical).
How does CVE-2022-34265 affect Django?
CVE-2022-34265 affects Django 3.2 before 3.2.14 and 4.0 before 4.0.6.
How can I fix CVE-2022-34265?
To fix CVE-2022-34265, update your Django installation to version 3.2.14 or 4.0.6 depending on your current version.
Where can I find more information about CVE-2022-34265?
You can find more information about CVE-2022-34265 on the Debian Security Tracker, the Debian bug report, and the NIST vulnerability database.