An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Jul 4, 2022 |
| Centos_linux | — | Upgrade rubygem-rest-clientUpgrade rubygem-fast_gettextUpgrade rubygem-highlineUpgrade rubygem-unf_extUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cliUpgrade rubygem-http-cookieUpgrade rubygem-powerbarUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade python39-pulp_manifestUpgrade rubygem-ffi-debuginfoUpgrade rubygem-domain_nameUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-ffiUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-amazing_printUpgrade satellite-cliUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-oauthUpgrade rubygem-jwtUpgrade rubygem-little-pluggerUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-ffi-debugsourceUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-gssapiUpgrade rubygem-apipie-bindingsUpgrade rubygem-netrcUpgrade rubygem-mime-typesUpgrade rubygem-multi_jsonUpgrade satellite-maintainUpgrade rubygem-unicodeUpgrade rubygem-unicode-display_widthUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_openscap | Nov 17, 2022 | Jul 4, 2022 |
| Debian | — | Upgrade python-django | Oct 31, 2022 | Jul 4, 2022 |
| Freebsd | — | Upgrade py38-django40Upgrade py310-django32Upgrade py38-django32Upgrade py39-django40Upgrade py39-django32Upgrade py310-django40Upgrade py37-django32 | Nov 4, 2022 | Jul 4, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-ffi-debuginfoUpgrade rubygem-unf_extUpgrade rubygem-mime-types-dataUpgrade foreman-cliUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-amazing_printUpgrade rubygem-gssapiUpgrade rubygem-unicode-debugsourceUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unfUpgrade rubygem-apipie-bindingsUpgrade rubygem-localeUpgrade satellite-cloneUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-fast_gettextUpgrade rubygem-rest-clientUpgrade rubygem-unicode-debuginfoUpgrade rubygem-foreman_maintainUpgrade rubygem-http-cookieUpgrade rubygem-little-pluggerUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-oauthUpgrade rubygem-powerbarUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-highlineUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unicode-display_widthUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hashieUpgrade rubygem-ffi-debugsourceUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-ffiUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-multi_jsonUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_discovery | Nov 17, 2022 | Jul 4, 2022 |
| Rocky_linux | — | Upgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxx | Mar 12, 2024 | Jul 4, 2022 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-django | Mar 22, 2023 | Jul 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub