[ASA-202204-9] python-django: sql injection

[Levente Polyak]

Arch Linux Security Advisory ASA-202204-9
=========================================

Severity: High
Date    : 2022-04-12
CVE-ID  : CVE-2022-28346 CVE-2022-28347
Package : python-django
Type    : sql injection
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2667

Summary
=======

The package python-django before version 4.0.4-1 is vulnerable to sql
injection.

Resolution
==========

Upgrade to 4.0.4-1.

# pacman -Syu "python-django>=4.0.4-1"

The problems have been fixed upstream in version 4.0.4.

Workaround
==========

None.

Description
===========

- CVE-2022-28346 (sql injection)

QuerySet.annotate(), aggregate(), and extra() methods were subject to
SQL injection in column aliases, using a suitably crafted dictionary,
with dictionary expansion, as the **kwargs passed to these methods.

- CVE-2022-28347 (sql injection)

QuerySet.explain() method was subject to SQL injection in option names,
using a suitably crafted dictionary, with dictionary expansion, as the
**options argument.

Impact
======

An attacker is able to perform an SQL injection via a specially crafted
input.

References
==========

https://www.djangoproject.com/weblog/2022/apr/11/security-releases/
https://github.com/django/django/commit/93cae5cb2f9a4ef1514cf1a41f714fef08005200
https://github.com/django/django/commit/800828887a0509ad1162d6d407e94d8de7eafc60
https://github.com/django/django/commit/2044dac5c6968441be6f534c4139bcf48c5c7e48
https://github.com/django/django/commit/2c09e68ec911919360d5f8502cefc312f9e03c5d
https://github.com/django/django/commit/6723a26e59b0b5429a0c5873941e01a2e1bdbb81
https://github.com/django/django/commit/00b0fc50e1738c7174c495464a5ef069408a4402
https://github.com/django/django/commit/9e19accb6e0a00ba77d5a95a91675bf18877c72d
https://github.com/django/django/commit/29a6c98b4c13af82064f993f0acc6e8fafa4d3f5
https://security.archlinux.org/CVE-2022-28346
https://security.archlinux.org/CVE-2022-28347
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20220412/41824c9e/attachment.sig>