0
0
mirror of https://github.com/django/django.git synced 2024-11-28 21:43:13 +01:00
django/docs/releases/3.2.14.txt
Mariusz Felisiak 54eb8a374d Fixed CVE-2022-34265 -- Protected Trunc(kind)/Extract(lookup_name) against SQL injection.
Thanks Takuto Yoshikai (Aeye Security Lab) for the report.
2022-07-04 08:13:41 +02:00

19 lines
693 B
Plaintext

===========================
Django 3.2.14 release notes
===========================
*July 4, 2022*
Django 3.2.14 fixes a security issue with severity "high" in 3.2.13.
CVE-2022-34265: Potential SQL injection via ``Trunc(kind)`` and ``Extract(lookup_name)`` arguments
==================================================================================================
:class:`Trunc() <django.db.models.functions.Trunc>` and
:class:`Extract() <django.db.models.functions.Extract>` database functions were
subject to SQL injection if untrusted data was used as a
``kind``/``lookup_name`` value.
Applications that constrain the lookup name and kind choice to a known safe
list are unaffected.