Magento 2.2 patch for PRODSECBUG-2198 in composer.patches.json format for magento/framework. See for magento/module-catalog https://gist.github.com/peterjaap/d7eaceb0e28e76cb92426a9defed0d9a

PRODSECBUG-2198-2.2-CE-2019-03-25-08-43-16-framework.patch

diff --git a/DB/Adapter/Pdo/Mysql.php b/DB/Adapter/Pdo/Mysql.php
index 1449d6d..38085a3 100644
--- a/DB/Adapter/Pdo/Mysql.php
+++ b/DB/Adapter/Pdo/Mysql.php
@@ -2904,7 +2904,7 @@ class Mysql extends \Zend_Db_Adapter_Pdo_Mysql implements AdapterInterface
                 if (isset($condition['to'])) {
                     $query .= empty($query) ? '' : ' AND ';
                     $to     = $this->_prepareSqlDateCondition($condition, 'to');
-                    $query = $this->_prepareQuotedSqlCondition($query . $conditionKeyMap['to'], $to, $fieldName);
+                    $query = $query . $this->_prepareQuotedSqlCondition($conditionKeyMap['to'], $to, $fieldName);
                 }
             } elseif (array_key_exists($key, $conditionKeyMap)) {
                 $value = $condition[$key];
-- 
2.7.4