An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6.
Priority HIGH 80CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-89.
Summary
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
Why it matters now
EPSS 0.73607 99th percentileScored 2026-11-07
Fix Partial Django (PyPI): 3.2.14, 4.0.6Red Hat: 2 advisoriesRed Hat: 2 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | Django (PyPI) | 3.2a1 to before 3.2.14 | 3.2.14 | Patch available | GHSA-p64x-8rxx-wf6q |
| — | Django (PyPI) | 4.0a1 to before 4.0.6 | 4.0.6 | Patch available | GHSA-p64x-8rxx-wf6q |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- Django (PyPI) Vendor— Affected 3.2a1 to before 3.2.14 Fixed in 3.2.14 Patch available GHSA-p64x-8rxx-wf6q
- Django (PyPI) Vendor— Affected 4.0a1 to before 4.0.6 Fixed in 4.0.6 Patch available GHSA-p64x-8rxx-wf6q
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* | 3.2 to before 3.2.14; 4.0 to before 4.0.6 | Vulnerable | djangoproject |
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions 3.2 to before 3.2.14; 4.0 to before 4.0.6 Vulnerable ·djangoproject
Remediation
- Fix · GHSA-p64x-8rxx-wf6q Django (PyPI) Fixed in 3.2.14 Advisory →
- Fix · GHSA-p64x-8rxx-wf6q Django (PyPI) Fixed in 4.0.6 Advisory →
Red Hat 2 advisories
- RHSA-2022:8506 Released 2022-11-16 · Red Hat rating ImportantSatellite 6.12 Release
- Red Hat Satellite 6.12 for RHEL 8 candlepin-4.1.15-1.el8sat, candlepin-selinux-4.1.15-1.el8sat, foreman-3.3.0.17-1.el8sat +19
- RHSA-2022:5738 Released 2022-07-27 · Red Hat rating ImportantDjango 3.2.14 Security Update
- RHUI 4 for RHEL 8 python-django-3.2.14-3.el8ui, python38-django-3.2.14-3.el8ui
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Storage 3 | Affected | No fix yet |
| Red Hat Update Infrastructure 3 for Cloud Providers | Affected | No fix yet |
| RHUI 4 for RHEL 8 | Fixed | RHSA-2022:5738 |
| Red Hat Satellite 6.12 for RHEL 8 | Fixed | RHSA-2022:8506 |
Not affected: 5 products
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2
- Red Hat Satellite 6
- Red Hat Satellite 6.12 for RHEL 8
Timeline
- 2026-10-02 Threatist record created from CVE-2022-34265
- 2026-10-03 Alias added: GHSA-p64x-8rxx-wf6q
References
Patch 2
Advisory 6
Other 13
- https://groups.google.com/forum/#%21forum/django-announce
- https://github.com/django/django/commit/0dc9c016fadb71a067e5a42be30164e3f96c0492
- https://github.com/django/django/commit/5e2f4ddf2940704a26a4ac782b851989668d74db
- https://github.com/django/django/commit/877c800f255ccaa7abde1fb944de45d1616f5cc9
- https://github.com/django/django/commit/a9010fe5555e6086a9d9ae50069579400ef0685e
- https://docs.djangoproject.com/en/4.0/releases/security
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-213.yaml
- https://groups.google.com/forum/#!forum/django-announce
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI
- https://security.netapp.com/advisory/ntap-20220818-0006
- https://www.djangoproject.com/weblog/2022/jul/04/security-releases
More djangoproject Django vulnerabilities
- TI-2020-05994 Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection… CVSS 3.1CRITICAL 9.8
- TI-2023-10198 An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0… CVSS 3.1HIGH 7.5
- TI-2019-14306 Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. CVSS 3.1CRITICAL 9.8
- TI-2019-10595 An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x… CVSS 3.0CRITICAL 9.8
- TI-2021-14006 Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection… CVSS 3.1CRITICAL 9.8
- TI-2025-35707 SQL injection in djangoproject Django CVSS 3.1HIGH 8.1
Sources
- CVE-2022-34265 · CVE Program
- CVE-2022-34265 · NVD
- FIRST EPSS
- GHSA-p64x-8rxx-wf6q · GitHub Advisory Database · CC BY 4.0
- CVE-2022-34265 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences