Arch Linux Security Advisory ASA-202204-9 ========================================= Severity: High Date : 2022-04-12 CVE-ID : CVE-2022-28346 CVE-2022-28347 Package : python-django Type : sql injection Remote : Yes Link : https://security.archlinux.org/AVG-2667 Summary ======= The package python-django before version 4.0.4-1 is vulnerable to sql injection. Resolution ========== Upgrade to 4.0.4-1. # pacman -Syu "python-django>=4.0.4-1" The problems have been fixed upstream in version 4.0.4. Workaround ========== None. Description =========== - CVE-2022-28346 (sql injection) QuerySet.annotate(), aggregate(), and extra() methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods. - CVE-2022-28347 (sql injection) QuerySet.explain() method was subject to SQL injection in option names, using a suitably crafted dictionary, with dictionary expansion, as the **options argument. Impact ====== An attacker is able to perform an SQL injection via a specially crafted input. References ========== https://www.djangoproject.com/weblog/2022/apr/11/security-releases/ https://github.com/django/django/commit/93cae5cb2f9a4ef1514cf1a41f714fef0800... https://github.com/django/django/commit/800828887a0509ad1162d6d407e94d8de7ea... https://github.com/django/django/commit/2044dac5c6968441be6f534c4139bcf48c5c... https://github.com/django/django/commit/2c09e68ec911919360d5f8502cefc312f9e0... https://github.com/django/django/commit/6723a26e59b0b5429a0c5873941e01a2e1bd... https://github.com/django/django/commit/00b0fc50e1738c7174c495464a5ef069408a... https://github.com/django/django/commit/9e19accb6e0a00ba77d5a95a91675bf18877... https://github.com/django/django/commit/29a6c98b4c13af82064f993f0acc6e8fafa4... https://security.archlinux.org/CVE-2022-28346 https://security.archlinux.org/CVE-2022-28347