critical
CVE-2022-28346
Django: SQL injection in QuerySet.annotate(),aggregate() and extra()
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA, Bitnami. Rated lower by Red Hat (high), Ubuntu (high).
Description
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | django | 2.2.28, 3.2.13, 4.0.4 |
| pip::GitHub Security Advisory pip | django | 2.2.28, 3.2.13, 4.0.4 |
| alpine 3.16 | py3-django | 3.2.13-r0 |
| alpine 3.17 | py3-django | 3.2.13-r0 |
| alpine 3.18 | py3-django | 3.2.13-r0 |
| alpine 3.19 | py3-django | 3.2.13-r0 |
| alpine 3.20 | py3-django | 3.2.13-r0 |
| alpine 3.21 | py3-django | 3.2.13-r0 |
| alpine 3.22 | py3-django | 3.2.13-r0 |
| alpine 3.23 | py3-django | 3.2.13-r0 |
| alpine 3.24 | py3-django | 3.2.13-r0 |
| alpine edge | py3-django | 3.2.13-r0 |
Show all 36 entries from 29 sources
| Source | Package | Fixed in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | django | 2.2.28, 3.2.13, 4.0.4 |
| pip::GitHub Security Advisory pip | django | 2.2.28, 3.2.13, 4.0.4 |
| alpine 3.16 | py3-django | 3.2.13-r0 |
| alpine 3.17 | py3-django | 3.2.13-r0 |
| alpine 3.18 | py3-django | 3.2.13-r0 |
| alpine 3.19 | py3-django | 3.2.13-r0 |
| alpine 3.20 | py3-django | 3.2.13-r0 |
| alpine 3.21 | py3-django | 3.2.13-r0 |
| alpine 3.22 | py3-django | 3.2.13-r0 |
| alpine 3.23 | py3-django | 3.2.13-r0 |
| alpine 3.24 | py3-django | 3.2.13-r0 |
| alpine edge | py3-django | 3.2.13-r0 |
| debian 10 | python-django | 1:1.11.29-1+deb10u3 |
| debian 11 | python-django | 2:2.2.28-1~deb11u1 |
| debian 12 | python-django | 2:3.2.13-1 |
| debian 13 | python-django | 2:3.2.13-1 |
| debian 14 | python-django | 2:3.2.13-1 |
| debian 9 | python-django | 1:1.10.7-2+deb9u16 |
| echo | python-django | 2:3.2.13-1 |
| Red Hat | graphite-web | no fix listed |
| Red Hat | python-django | no fix listed |
| Red Hat | python-django-bash-completion | no fix listed |
| Red Hat | python-pulp-container | no fix listed |
| Red Hat | python2-django | no fix listed |
| Red Hat | python3-django | no fix listed |
| Red Hat | python3-pulp-container | no fix listed |
| seal Red Hat 8 | libsolv | 0.7.20-6.el8+sp999 |
| seal Red Hat 8 | seal-libsolv | 0.7.20-6.el8+sp999 |
| ubuntu 14.04-ESM | python-django | 1.6.11-0ubuntu1.3+esm5 |
| ubuntu 16.04-ESM | python-django | 1.8.7-1ubuntu5.15+esm5 |
| ubuntu 18.04 | python-django | 1:1.11.11-1ubuntu1.17 |
| ubuntu 18.04-ESM | python-django | 1:1.11.11-1ubuntu1.17 |
| ubuntu 20.04 | python-django | 2:2.2.12-1ubuntu0.11 |
| ubuntu 20.04-ESM | python-django | 2:2.2.12-1ubuntu0.11 |
| ubuntu 21.10 | python-django | 2:2.2.24-1ubuntu1.4 |
| ubuntu 22.04 | python-django | 3.2.12-2ubuntu1 |
References
- http://www.openwall.com/lists/oss-security/2022/04/11/1
- https://access.redhat.com/security/cve/CVE-2022-28346
- https://docs.djangoproject.com/en/4.0/releases/security
- https://docs.djangoproject.com/en/4.0/releases/security/
- https://github.com/advisories/GHSA-2gwj-7jmv-h26r
- https://github.com/django/django
- https://github.com/django/django/commit/2044dac5c6968441be6f534c4139bcf48c5c7e48
- https://github.com/django/django/commit/2c09e68ec911919360d5f8502cefc312f9e03c5d
All 27 references
- https://github.com/django/django/commit/800828887a0509ad1162d6d407e94d8de7eafc60
- https://github.com/django/django/commit/93cae5cb2f9a4ef1514cf1a41f714fef08005200
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-190.yaml
- https://groups.google.com/forum/#!forum/django-announce
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.debian.org/debian-lts-announce/2022/04/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
- https://nvd.nist.gov/vuln/detail/CVE-2022-28346
- https://security.netapp.com/advisory/ntap-20220609-0002
- https://security.netapp.com/advisory/ntap-20220609-0002/
- https://ubuntu.com/security/notices/USN-5373-1
- https://ubuntu.com/security/notices/USN-5373-2
- https://www.cve.org/CVERecord?id=CVE-2022-28346
- https://www.debian.org/security/2022/dsa-5254
- https://www.djangoproject.com/weblog/2022/apr/11/security-releases
- https://www.djangoproject.com/weblog/2022/apr/11/security-releases/