mirror of
https://github.com/django/django.git
synced 2024-12-27 19:46:22 +00:00
23 lines
988 B
Plaintext
23 lines
988 B
Plaintext
===========================
|
|
Django 2.2.28 release notes
|
|
===========================
|
|
|
|
*April 11, 2022*
|
|
|
|
Django 2.2.28 fixes two security issues with severity "high" in 2.2.27.
|
|
|
|
CVE-2022-28346: Potential SQL injection in ``QuerySet.annotate()``, ``aggregate()``, and ``extra()``
|
|
====================================================================================================
|
|
|
|
:meth:`.QuerySet.annotate`, :meth:`~.QuerySet.aggregate`, and
|
|
:meth:`~.QuerySet.extra` methods were subject to SQL injection in column
|
|
aliases, using a suitably crafted dictionary, with dictionary expansion, as the
|
|
``**kwargs`` passed to these methods.
|
|
|
|
CVE-2022-28347: Potential SQL injection via ``QuerySet.explain(**options)`` on PostgreSQL
|
|
=========================================================================================
|
|
|
|
:meth:`.QuerySet.explain` method was subject to SQL injection in option names,
|
|
using a suitably crafted dictionary, with dictionary expansion, as the
|
|
``**options`` argument.
|