[Snyk:High] django SQL Injection (due by 05/13/2022)

[cnlucas]

Summary

Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design.
Affected versions of this package are vulnerable to SQL Injection in QuerySet.annotate(), aggregate(), and extra() methods, in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to these methods.
Affected versions of this package are vulnerable to SQL Injection via QuerySet.explain(**options) in option names, using a suitably crafted dictionary, with dictionary expansion, as the **options argument on PostgreSQL.
https://app.snyk.io/org/fecgov/project/ff0dca01-794e-4c1c-bf1f-0c0f8932fadd/#issue-SNYK-PYTHON-DJANGO-2606969
https://app.snyk.io/org/fecgov/project/ff0dca01-794e-4c1c-bf1f-0c0f8932fadd/#issue-SNYK-PYTHON-DJANGO-2606966

Remediation: Pin django to version 2.2.28 or 3.2.13 or 4.0.4

Technical considerations

• It would be easiest to pin Django to 3.2.13, as we are currently on 3.1.14

Related issues

• Upgrade Wagtail to 2.15.4 LTS #4807
• [Snyk:Medium] django Denial of Service (DoS)(due by 05/22/2022) #5126

Completion criteria

• Verify that this is indeed a vulnerability for us and either complete the remediation or document, close the ticket and snooze the Snyk alert.

[patphongs]

Thanks @cnlucas for taking this off my hands! 🎉