Skip to content
OpenAdvisories
Critical RHSA-2022:5602 2 CVEs

Red Hat Security Advisory: RHUI 4.1.1 release - Security Fixes and Enhancement Update

Published Sep 18, 2024 · Updated Feb 18, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · Rhui 4 rhui:4::el8 python-django 0:3.2.13-2.el8ui
Red Hat · Rhui 4 rhui:4::el8 python-pulpcore 0:3.17.6-3.el8ui
Red Hat · Rhui 4 rhui:4::el8 python38-pulpcore 0:3.17.6-3.el8ui

Vulnerabilities 2

  • Critical 9.8
    CVE-2022-28346 Public exploit EPSS 19%

    SQL Injection in Django

    An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the pass…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2022-28347

    SQL Injection in Django

    A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection paylo…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1636435
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1890389
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2010343
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2072447
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2072459
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2079376
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5602.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-28346
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-28346
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-28346
  • article
    https://www.djangoproject.com/weblog/2022/apr/11/security-releases/
  • report
    https://access.redhat.com/security/cve/CVE-2022-28347
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-28347
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-28347