Critical USN-5501-1 1 CVE

python-django vulnerability

Published Jul 4, 2022 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Django incorrectly handled certain SQL.
An attacker could possibly use this issue to expose sensitive information.

Fixed packages 3

Release	Package	Fixed in
Ubuntu · 18.04 LTS 18.04:LTS	python-django	1:1.11.11-1ubuntu1.18
Ubuntu · 20.04 LTS 20.04:LTS	python-django	2:2.2.12-1ubuntu0.12
Ubuntu · 22.04 LTS 22.04:LTS	python-django	2:3.2.12-2ubuntu1.1

Vulnerabilities 1

Critical 9.8

CVE-2022-34265 Public exploit EPSS 74%

Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection

An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc() and Extract() database functions are subject to SQL injection if untrusted data is used as a kind/lookup_name value. Applications that constrain the lookup name and kind cho…

python-django django python-django py3-django Debian Ubuntu Alpine PyPI

Jul 4, 2022

References

report
https://ubuntu.com/security/CVE-2022-34265