An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade py3-django | Aug 22, 2024 | Jul 4, 2022 |
| Centos_linux | — | Upgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cliUpgrade rubygem-unf_extUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-highlineUpgrade rubygem-loggingUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-http-cookieUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-localeUpgrade python39-pulp_manifestUpgrade rubygem-hashieUpgrade foreman-cliUpgrade rubygem-amazing_printUpgrade rubygem-domain_nameUpgrade rubygem-clampUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-oauthUpgrade satellite-cliUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unicode-debugsourceUpgrade rubygem-gssapiUpgrade rubygem-apipie-bindingsUpgrade rubygem-mime-types-dataUpgrade rubygem-netrcUpgrade rubygem-unicodeUpgrade rubygem-unicode-display_widthUpgrade rubygem-multi_jsonUpgrade rubygem-mime-typesUpgrade satellite-maintainUpgrade satellite-cloneUpgrade rubygem-unicode-debuginfo | Nov 17, 2022 | Jul 4, 2022 |
| Debian | — | Upgrade python-django | Oct 31, 2022 | Jul 4, 2022 |
| Freebsd | — | Upgrade py310-django40Upgrade py37-django32Upgrade py38-django40Upgrade py39-django32Upgrade py38-django32Upgrade py39-django40Upgrade py310-django32 | Nov 4, 2022 | Jul 4, 2022 |
| Gentoo Linux | — | Upgrade dev-python/django. | Sep 18, 2025 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade rubygem-oauthUpgrade rubygem-unfUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-apipie-bindingsUpgrade rubygem-foreman_maintainUpgrade rubygem-hammer_cliUpgrade rubygem-localeUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-little-pluggerUpgrade rubygem-http-cookieUpgrade rubygem-fast_gettextUpgrade rubygem-domain_nameUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unf_extUpgrade rubygem-gssapiUpgrade python39-pulp_manifestUpgrade rubygem-ffi-debuginfoUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade foreman-cliUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-amazing_printUpgrade rubygem-powerbarUpgrade rubygem-unicode-debugsourceUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_katelloUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-netrcUpgrade rubygem-unicode-display_widthUpgrade rubygem-highlineUpgrade rubygem-ffiUpgrade rubygem-hashieUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-ffi-debugsourceUpgrade rubygem-jwtUpgrade satellite-maintainUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-logging | Nov 17, 2022 | Jul 4, 2022 |
| Rocky_linux | — | Upgrade libdb-sql-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxx | Mar 12, 2024 | Jul 4, 2022 |
| Ubuntu | — | Upgrade python3-djangoUpgrade python-django | Mar 22, 2023 | Jul 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub