SQL Injection Flaw in Django !

Django is a free and open-source, Python-based web framework that follows the model–template–views (MTV) architectural pattern.

Django is maintained by the independent organization Django Software Foundation.

The latest releases of the framework, Django 4.0.6 and 3.2.14, addressed a high-severity SQL Injection vulnerability tracked as CVE-2022-34265.

According to the release note, the flaw resides in the Trunc() and Extract() database functions, it can be exploited if untrusted data was used as a kind/lookup_name value.

Performing input sanitization for these functions it is possible to mitigate the risk of exploitation of the flaw.

The development team also releases security patches as temporary solutions before upgrading to the latest versions.

Not more information available for now in the publisher site itself to review it further. Will be updated once more information are known to us