An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Jul 4, 2022 |
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-clampUpgrade satellite-cliUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade python39-pulp_manifestUpgrade foreman-cliUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-oauthUpgrade rubygem-unf_extUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cliUpgrade rubygem-hashieUpgrade rubygem-http-cookieUpgrade rubygem-domain_nameUpgrade rubygem-foreman_maintainUpgrade rubygem-localeUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-loggingUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-highlineUpgrade rubygem-mime-typesUpgrade rubygem-netrcUpgrade rubygem-multi_jsonUpgrade rubygem-gssapiUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-little-pluggerUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_openscapUpgrade satellite-cloneUpgrade satellite-maintainUpgrade rubygem-unicodeUpgrade rubygem-unicode-display_widthUpgrade rubygem-mime-types-dataUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-apipie-bindingsUpgrade rubygem-ffi-debugsource | Nov 17, 2022 | Jul 4, 2022 |
| Debian | — | Upgrade python-django | Oct 31, 2022 | Jul 4, 2022 |
| Freebsd | — | Upgrade py37-django32Upgrade py310-django40Upgrade py39-django32Upgrade py38-django32Upgrade py38-django40Upgrade py310-django32Upgrade py39-django40 | Nov 4, 2022 | Jul 4, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-unicode-display_widthUpgrade rubygem-ffi-debugsourceUpgrade rubygem-loggingUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-multi_jsonUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-mime-typesUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade python39-pulp_manifestUpgrade rubygem-domain_nameUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cliUpgrade rubygem-unicodeUpgrade rubygem-rest-clientUpgrade rubygem-gssapiUpgrade rubygem-http-cookieUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-mime-types-dataUpgrade satellite-cliUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-ffi-debuginfoUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-apipie-bindingsUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-little-pluggerUpgrade rubygem-foreman_maintainUpgrade rubygem-localeUpgrade rubygem-oauthUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-powerbarUpgrade rubygem-amazing_printUpgrade rubygem-unf_extUpgrade satellite-clone | Nov 17, 2022 | Jul 4, 2022 |
| Rocky_linux | — | Upgrade libdb-debuginfoUpgrade libdb-debugsourceUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxxUpgrade libdb-utils-debuginfo | Mar 12, 2024 | Jul 4, 2022 |
| Ubuntu | — | Upgrade python-djangoUpgrade python3-django | Mar 22, 2023 | Jul 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub