blob: a894bddb3c55c706c2c5b0ac768e5671a0b101d6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
===========================
Django 2.2.28 release notes
===========================
*April 11, 2022*
Django 2.2.28 fixes two security issues with severity "high" in 2.2.27.
CVE-2022-28346: Potential SQL injection in ``QuerySet.annotate()``, ``aggregate()``, and ``extra()``
====================================================================================================
:meth:`.QuerySet.annotate`, :meth:`~.QuerySet.aggregate`, and
:meth:`~.QuerySet.extra` methods were subject to SQL injection in column
aliases, using a suitably crafted dictionary, with dictionary expansion, as the
``**kwargs`` passed to these methods.
|
