python-django: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments

🗓️ 16 Nov 2022 15:09:28Reported by RedHatType

redhat🔗 access.redhat.com👁 26 Views

Potential SQL injection in Django via Trunc and Extract from untrusted kind or lookup_name values.

Reporter	Title	Published	Views	Family All 93
ALT Linux	Security fix for the ALT Linux 10 package python3-module-django version 3.2.15-alt1	30 Aug 202200:00	–	altlinux
FreeBSD	Django -- multiple vulnerabilities	21 Jun 202200:00	–	freebsd
GithubExploit	Exploit for SQL Injection in Djangoproject Django	24 Aug 202207:29	–	githubexploit
GithubExploit	Exploit for SQL Injection in Djangoproject Django	7 Jul 202207:45	–	githubexploit
GithubExploit	Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware	3 Apr 202018:47	–	githubexploit
AlpineLinux	CVE-2022-34265	4 Jul 202200:00	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in Python-Django	14 Sep 202612:41	–	astralinux
BDU FSTEC	The vulnerability of the Trunc/Extract function in the Django web development framework allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	8 Jul 202200:00	–	bdu_fstec
Tenable Nessus	Rocky Linux 8 [CIQ] Security Update: libdb-cxx / libdb-cxx-debuginfo / libdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2022_8506)	1 Oct 202600:00	–	nessus
Tenable Nessus	Debian dla-3164 : python-django - security update	28 Oct 202200:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	python39-django	3.2.14-2.el8pc	python39-django-3.2.14-2.el8pc.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2022-34265
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-34265
cve	www.cve.org/CVERecord

29 Sep 2026 16:51Current

6.5Medium risk

Vulners AI Score6.5

CVSS 27.5

CVSS 3.19.8

EPSS0.73607

Django SQL injection Trunc function Extract function Untrusted input