The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Apr 12, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Apr 12, 2022 |
| Centos_linux | — | Upgrade rubygem-jwtUpgrade rubygem-hammer_cliUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unicodeUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-unicode-display_widthUpgrade tfm-rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-rest-clientUpgrade rubygem-domain_nameUpgrade tfm-rubygem-unicodeUpgrade tfm-rubygem-unfUpgrade tfm-rubygem-multi_jsonUpgrade tfm-rubygem-clampUpgrade rubygem-amazing_printUpgrade tfm-runtimeUpgrade rubygem-powerbarUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-rest-clientUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_katelloUpgrade foreman-cliUpgrade tfm-rubygem-http-cookieUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-little-pluggerUpgrade rubygem-mime-types-dataUpgrade rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-powerbarUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-apipie-bindingsUpgrade rubygem-foreman_maintainUpgrade rubygem-oauthUpgrade satellite-cloneUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-amazing_printUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unicode-debuginfoUpgrade rubygem-mime-typesUpgrade tfm-rubygem-hammer_cli_katelloUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-unf_extUpgrade rubygem-unicode-debugsourceUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-unicode-display_widthUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-localeUpgrade rubygem-highlineUpgrade rubygem-clampUpgrade rubygem-netrcUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade satellite-cliUpgrade tfm-rubygem-localeUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_adminUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade tfm-rubygem-oauthUpgrade rubygem-fast_gettextUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-unf_extUpgrade rubygem-hashieUpgrade tfm-rubygem-apipie-bindingsUpgrade rubygem-loggingUpgrade tfm-rubygem-hashieUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-domain_name | Jul 14, 2022 | Apr 12, 2022 |
| Debian | — | Upgrade python-django | Apr 18, 2022 | Apr 12, 2022 |
| Freebsd | — | Upgrade py39-django32Upgrade py310-django22Upgrade py39-django22Upgrade py38-django32Upgrade py310-django32Upgrade py37-django22Upgrade py38-django40Upgrade py37-django32Upgrade py39-django40Upgrade py38-django22Upgrade py310-django40 | Nov 4, 2022 | Apr 12, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-clampUpgrade tfm-rubygem-fast_gettextUpgrade tfm-rubygem-unicodeUpgrade rubygem-jwtUpgrade rubygem-unfUpgrade tfm-rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-multi_jsonUpgrade foreman-cliUpgrade rubygem-unf_extUpgrade rubygem-mime-types-dataUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-hammer_cli_foreman_tasksUpgrade rubygem-domain_nameUpgrade tfm-rubygem-unicode-display_widthUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade tfm-rubygem-netrcUpgrade tfm-rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-highlineUpgrade tfm-rubygem-hammer_cli_foremanUpgrade rubygem-oauthUpgrade rubygem-fast_gettextUpgrade rubygem-little-pluggerUpgrade tfm-rubygem-rest-clientUpgrade tfm-rubygem-amazing_printUpgrade rubygem-localeUpgrade rubygem-rest-clientUpgrade tfm-rubygem-unfUpgrade rubygem-amazing_printUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade tfm-rubygem-mime-types-dataUpgrade satellite-cloneUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cliUpgrade tfm-rubygem-clampUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade tfm-rubygem-http-cookieUpgrade satellite-cliUpgrade tfm-rubygem-apipie-bindingsUpgrade tfm-rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade tfm-rubygem-unf_ext-debuginfoUpgrade tfm-rubygem-oauthUpgrade tfm-rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-unicode-display_widthUpgrade tfm-rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-powerbarUpgrade tfm-rubygem-hashieUpgrade tfm-rubygem-mime-typesUpgrade rubygem-multi_jsonUpgrade tfm-rubygem-hammer_cli_katelloUpgrade rubygem-unicodeUpgrade tfm-rubygem-loggingUpgrade tfm-rubygem-unf_extUpgrade tfm-rubygem-localeUpgrade rubygem-unf_ext-debugsourceUpgrade tfm-rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_openscapUpgrade tfm-rubygem-hammer_cli_foreman_bootdiskUpgrade tfm-rubygem-hammer_cliUpgrade rubygem-hammer_cli_foremanUpgrade tfm-rubygem-unicode-debuginfoUpgrade tfm-rubygem-hammer_cli_foreman_templatesUpgrade tfm-rubygem-hammer_cli_foreman_webhooksUpgrade tfm-runtimeUpgrade rubygem-loggingUpgrade rubygem-unicode-debuginfoUpgrade tfm-rubygem-little-pluggerUpgrade tfm-rubygem-jwtUpgrade tfm-rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_katelloUpgrade tfm-rubygem-highlineUpgrade rubygem-netrcUpgrade tfm-rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-maintainUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_admin | Jul 14, 2022 | Apr 12, 2022 |
| Rocky_linux | — | Upgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfo | Mar 12, 2024 | Apr 12, 2022 |
| Suse | — | Upgrade python3-django | Jan 4, 2023 | Apr 12, 2022 |
| Ubuntu | — | Upgrade python-django (Ubuntu Pro)Upgrade python-djangoUpgrade python3-djangoUpgrade python3-django (Ubuntu Pro) | Mar 22, 2023 | Apr 12, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub