diff options
| author | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2022-04-01 13:48:47 +0200 |
|---|---|---|
| committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2022-04-11 09:02:58 +0200 |
| commit | 00b0fc50e1738c7174c495464a5ef069408a4402 (patch) | |
| tree | cd5668d0ea1c96bbd62c5e922b0d1988c2287e90 /docs | |
| parent | 800828887a0509ad1162d6d407e94d8de7eafc60 (diff) | |
[4.0.x] Fixed CVE-2022-28347 -- Protected QuerySet.explain(**options) against SQL injection on PostgreSQL.
Backport of 6723a26e59b0b5429a0c5873941e01a2e1bdbb81 from main.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/2.2.28.txt | 7 | ||||
| -rw-r--r-- | docs/releases/3.2.13.txt | 7 | ||||
| -rw-r--r-- | docs/releases/4.0.4.txt | 7 |
3 files changed, 21 insertions, 0 deletions
diff --git a/docs/releases/2.2.28.txt b/docs/releases/2.2.28.txt index a894bddb3c..43270fc5c0 100644 --- a/docs/releases/2.2.28.txt +++ b/docs/releases/2.2.28.txt @@ -13,3 +13,10 @@ CVE-2022-28346: Potential SQL injection in ``QuerySet.annotate()``, ``aggregate( :meth:`~.QuerySet.extra` methods were subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the ``**kwargs`` passed to these methods. + +CVE-2022-28347: Potential SQL injection via ``QuerySet.explain(**options)`` on PostgreSQL +========================================================================================= + +:meth:`.QuerySet.explain` method was subject to SQL injection in option names, +using a suitably crafted dictionary, with dictionary expansion, as the +``**options`` argument. diff --git a/docs/releases/3.2.13.txt b/docs/releases/3.2.13.txt index ee20aa2ca1..b7afbb8ed7 100644 --- a/docs/releases/3.2.13.txt +++ b/docs/releases/3.2.13.txt @@ -15,6 +15,13 @@ CVE-2022-28346: Potential SQL injection in ``QuerySet.annotate()``, ``aggregate( aliases, using a suitably crafted dictionary, with dictionary expansion, as the ``**kwargs`` passed to these methods. +CVE-2022-28347: Potential SQL injection via ``QuerySet.explain(**options)`` on PostgreSQL +========================================================================================= + +:meth:`.QuerySet.explain` method was subject to SQL injection in option names, +using a suitably crafted dictionary, with dictionary expansion, as the +``**options`` argument. + Bugfixes ======== diff --git a/docs/releases/4.0.4.txt b/docs/releases/4.0.4.txt index 6c22788bd1..702cebbbe9 100644 --- a/docs/releases/4.0.4.txt +++ b/docs/releases/4.0.4.txt @@ -15,6 +15,13 @@ CVE-2022-28346: Potential SQL injection in ``QuerySet.annotate()``, ``aggregate( aliases, using a suitably crafted dictionary, with dictionary expansion, as the ``**kwargs`` passed to these methods. +CVE-2022-28347: Potential SQL injection via ``QuerySet.explain(**options)`` on PostgreSQL +========================================================================================= + +:meth:`.QuerySet.explain` method was subject to SQL injection in option names, +using a suitably crafted dictionary, with dictionary expansion, as the +``**options`` argument. + Bugfixes ======== |