CVE-2022-34265

NameCVE-2022-34265
DescriptionAn issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3164-1, DSA-5254-1
Debian Bugs1014541

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-django (PTS)buster1:1.11.29-1~deb10u1vulnerable
buster (security)1:1.11.29-1+deb10u5fixed
bullseye2:2.2.26-1~deb11u1vulnerable
bullseye (security)2:2.2.28-1~deb11u1fixed
bookworm, sid3:3.2.16-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-djangosourcebuster1:1.11.29-1+deb10u2DLA-3164-1
python-djangosourcebullseye2:2.2.28-1~deb11u1DSA-5254-1
python-djangosource(unstable)2:4.0.6-11014541

Notes

https://www.openwall.com/lists/oss-security/2022/07/04/2
https://www.djangoproject.com/weblog/2022/jul/04/security-releases/
https://github.com/django/django/commit/54eb8a374d5d98594b264e8ec22337819b37443c (main)
https://github.com/django/django/commit/0dc9c016fadb71a067e5a42be30164e3f96c0492 (4.0.6)
https://github.com/django/django/commit/a9010fe5555e6086a9d9ae50069579400ef0685e (3.2.14)

Search for package or bug name: Reporting problems