| Package | Affected versions | Patched versions |
|---|---|---|
| django | ≥ 3.2, < 3.2.14≥ 3.2a1, < 3.2.14≥ 4.0, < 4.0.6≥ 4.0a1, < 4.0.6 | 3.2.144.0.6 |
| django | ≥ 3.2, < 3.2.14≥ 4.0, < 4.0.6 | 3.2.144.0.6 |
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free