Read the docs
TI-2022-11106 Aliases CVE-2022-28346GHSA-2gwj-7jmv-h26r

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before…

Priority MEDIUM 60CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 7 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-89.

Summary

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs.

Why it matters now

EPSS 0.18661 97th percentileScored 2026-11-07
Fix Partial Django (PyPI): 2.2.28, 3.2.13, 4.0.4Red Hat: 6 advisoriesRed Hat: 7 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—Django (PyPI)2.2 to before 2.2.282.2.28Patch availableGHSA-2gwj-7jmv-h26r
—Django (PyPI)3.2 to before 3.2.133.2.13Patch availableGHSA-2gwj-7jmv-h26r
—Django (PyPI)4.0 to before 4.0.44.0.4Patch availableGHSA-2gwj-7jmv-h26r
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • Django (PyPI) Vendor— Affected 2.2 to before 2.2.28 Fixed in 2.2.28 Patch available GHSA-2gwj-7jmv-h26r
  • Django (PyPI) Vendor— Affected 3.2 to before 3.2.13 Fixed in 3.2.13 Patch available GHSA-2gwj-7jmv-h26r
  • Django (PyPI) Vendor— Affected 4.0 to before 4.0.4 Fixed in 4.0.4 Patch available GHSA-2gwj-7jmv-h26r

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*2.2 to before 2.2.28; 3.2 to before 3.2.13; 4.0 to before 4.0.4Vulnerabledjangoproject
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions 2.2 to before 2.2.28; 3.2 to before 3.2.13; 4.0 to before 4.0.4 Vulnerable ·djangoproject
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-2gwj-7jmv-h26r Django (PyPI) Fixed in 2.2.28 Advisory →
  • Fix · GHSA-2gwj-7jmv-h26r Django (PyPI) Fixed in 3.2.13 Advisory →
  • Fix · GHSA-2gwj-7jmv-h26r Django (PyPI) Fixed in 4.0.4 Advisory →

Red Hat 6 advisories

  • RHSA-2022:8872 Released 2022-12-07 · Red Hat rating Important
    Red Hat OpenStack Platform 16.1.9 (python-django20) security update
    • Red Hat OpenStack Platform 16.1 python-django20-2.0.13-18.el8ost, python-django20-bash-completion-2.0.13-18.el8ost, python3-django20-2.0.13-18.el8ost
  • RHSA-2022:5703 Released 2022-07-25 · Red Hat rating Important
    Red Hat Ansible Automation Platform 1.2 security update
    • Red Hat Automation Hub 4.2 for RHEL 7 python3-django-2.2.28-1.el7pc
    • Red Hat Automation Hub 4.2 for RHEL 8 python3-django-2.2.28-1.el8pc
  • RHSA-2022:5702 Released 2022-07-25 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.1.2 security and bug fix update
    • Red Hat Ansible Automation Platform 2.1 for RHEL 8 automation-controller-4.1.2-2.el8ap, automation-controller-cli-4.1.2-2.el8ap, automation-controller-server-4.1.2-2.el8ap +4
Show 3 more Red Hat advisories
  • RHSA-2022:5602 Released 2022-07-19 · Red Hat rating Important
    RHUI 4.1.1 release - Security Fixes and Enhancement Update
    • RHUI 4 for RHEL 8 python-django-3.2.13-2.el8ui, python-pulpcore-3.17.6-3.el8ui, python38-pulpcore-3.17.6-3.el8ui
  • RHSA-2022:5498 Released 2022-07-05 · Red Hat rating Moderate
    Satellite 6.11 Release
    • Red Hat Satellite 6.11 for RHEL 7 candlepin-4.1.13-1.el7sat, foreman-3.1.1.21-2.el7sat, libsolv-0.7.22-1.el7pc +4
    • Red Hat Satellite 6.11 for RHEL 8 candlepin-4.1.13-1.el8sat, foreman-3.1.1.21-2.el8sat, libsolv-0.7.22-1.el8pc +8
  • RHSA-2022:5115 Released 2022-06-22 · Red Hat rating Moderate
    Red Hat OpenStack Platform 16.2 (python-django20) security update
    • Red Hat OpenStack Platform 16.2 python-django20-2.0.13-17.el8ost

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 3AffectedNo fix planned: Will not fix
Red Hat Discovery 1AffectedNo fix yet
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Update Infrastructure 4 for Cloud ProvidersAffectedNo fix yet
RHUI 4 for RHEL 8Fixed RHSA-2022:5602
Red Hat Ansible Automation Platform 2.1 for RHEL 8Fixed RHSA-2022:5702
Red Hat Automation Hub 4.2 for RHEL 7Fixed RHSA-2022:5703
Red Hat Automation Hub 4.2 for RHEL 8Fixed RHSA-2022:5703
Red Hat OpenStack Platform 16.1Fixed RHSA-2022:8872
Red Hat OpenStack Platform 16.2Fixed RHSA-2022:5115
Red Hat Satellite 6.11 for RHEL 8Fixed RHSA-2022:5498
Not affected: 5 products
  • RHUI 4 for RHEL 8
  • Red Hat Ansible Automation Platform 2.1 for RHEL 8
  • Red Hat OpenStack Platform 16.2
  • Red Hat Satellite 6.11 for RHEL 7
  • Red Hat Satellite 6.11 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-28346
  2. 2026-10-03 Alias added: GHSA-2gwj-7jmv-h26r

References

Patch 3

Advisory 7

Other 13

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences