DEBIAN-CVE-2022-34265

DEBIAN-CVE-2022-34265 PUBLISHED CVSS 9.800000190734863 CRITICAL

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.

Risk Scores

CVSS v3.1

9.800000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Debian:13	python-django	0, 0, 0
Debian:12	python-django	0, 0, 0
Debian:11	python-django	2:2.2.26-1~deb11u1, 0, 2:2.2.24-1
Debian:14	python-django	0, 0, 0

Timeline

Jul 4, 2022 CVE Published
Apr 28, 2026 CVE Updated

References

https://security-tracker.debian.org/tracker/CVE-2022-34265 advisory

Open in Interactive Console →