kritik
CVE-2022-34265
python-django: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA, Bitnami. Daha düşük diyenler: Red Hat (yüksek), Ubuntu (orta).
Açıklama
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | django | 3.2.14, 4.0.6 |
| pip::GitHub Security Advisory pip | django | 3.2.14, 4.0.6 |
| alpine 3.16 | py3-django | 3.2.14-r0 |
| alpine 3.17 | py3-django | 3.2.14-r0 |
| alpine 3.18 | py3-django | 3.2.14-r0 |
| alpine 3.19 | py3-django | 3.2.14-r0 |
| alpine 3.20 | py3-django | 3.2.14-r0 |
| alpine 3.21 | py3-django | 3.2.14-r0 |
| alpine 3.22 | py3-django | 3.2.14-r0 |
| alpine 3.23 | py3-django | 3.2.14-r0 |
| alpine 3.24 | py3-django | 3.2.14-r0 |
| alpine edge | py3-django | 3.2.14-r0 |
27 kaynaktaki 30 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | django | 3.2.14, 4.0.6 |
| pip::GitHub Security Advisory pip | django | 3.2.14, 4.0.6 |
| alpine 3.16 | py3-django | 3.2.14-r0 |
| alpine 3.17 | py3-django | 3.2.14-r0 |
| alpine 3.18 | py3-django | 3.2.14-r0 |
| alpine 3.19 | py3-django | 3.2.14-r0 |
| alpine 3.20 | py3-django | 3.2.14-r0 |
| alpine 3.21 | py3-django | 3.2.14-r0 |
| alpine 3.22 | py3-django | 3.2.14-r0 |
| alpine 3.23 | py3-django | 3.2.14-r0 |
| alpine 3.24 | py3-django | 3.2.14-r0 |
| alpine edge | py3-django | 3.2.14-r0 |
| debian 10 | python-django | 1:1.11.29-1+deb10u2 |
| debian 11 | python-django | 2:2.2.28-1~deb11u1 |
| debian 12 | python-django | 2:4.0.6-1 |
| debian 13 | python-django | 2:4.0.6-1 |
| debian 14 | python-django | 2:4.0.6-1 |
| echo | python-django | 2:4.0.6-1 |
| rapidfort debian 12 | python-django | 0:4.0.6-1 |
| rapidfort debian 13 | python-django | 0:4.0.6-1 |
| Red Hat | python-django | düzeltme belirtilmemiş |
| Red Hat | python-django-bash-completion | düzeltme belirtilmemiş |
| Red Hat | python2-django | düzeltme belirtilmemiş |
| Red Hat | python2-django-doc | düzeltme belirtilmemiş |
| ubuntu 18.04 | python-django | 1:1.11.11-1ubuntu1.18 |
| ubuntu 18.04-ESM | python-django | 1:1.11.11-1ubuntu1.18 |
| ubuntu 20.04 | python-django | 2:2.2.12-1ubuntu0.12 |
| ubuntu 20.04-ESM | python-django | 2:2.2.12-1ubuntu0.12 |
| ubuntu 21.10 | python-django | 2:2.2.24-1ubuntu1.5 |
| ubuntu 22.04 | python-django | 2:3.2.12-2ubuntu1.1 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2022-34265
- https://docs.djangoproject.com/en/4.0/releases/security
- https://docs.djangoproject.com/en/4.0/releases/security/
- https://github.com/advisories/GHSA-p64x-8rxx-wf6q
- https://github.com/django/django
- https://github.com/django/django/commit/0dc9c016fadb71a067e5a42be30164e3f96c0492
- https://github.com/django/django/commit/5e2f4ddf2940704a26a4ac782b851989668d74db
- https://github.com/django/django/commit/877c800f255ccaa7abde1fb944de45d1616f5cc9
24 referansın hepsi
- https://github.com/django/django/commit/a9010fe5555e6086a9d9ae50069579400ef0685e
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-213.yaml
- https://groups.google.com/forum/#!forum/django-announce
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
- https://nvd.nist.gov/vuln/detail/CVE-2022-34265
- https://security.netapp.com/advisory/ntap-20220818-0006
- https://security.netapp.com/advisory/ntap-20220818-0006/
- https://ubuntu.com/security/notices/USN-5501-1
- https://www.cve.org/CVERecord?id=CVE-2022-34265
- https://www.debian.org/security/2022/dsa-5254
- https://www.djangoproject.com/weblog/2022/jul/04/security-releases
- https://www.djangoproject.com/weblog/2022/jul/04/security-releases/