PT-2020-5130 · Django Software Foundation+2 · Django+2
Norbert Szetei
·
Published
2020-03-04
·
Updated
2026-01-03
·
CVE-2020-9402
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Django versions 1.11 before 1.11.29
Django versions 2.2 before 2.2.11
Django versions 3.0 before 3.0.4
Description
The issue allows SQL Injection if untrusted data is used as a
tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL. This could potentially allow a remote attacker to execute arbitrary code.Recommendations
For Django version 1.11, update to version 1.11.29 or later.
For Django version 2.2, update to version 2.2.11 or later.
For Django version 3.0, update to version 3.0.4 or later.
As a temporary workaround, consider avoiding the use of untrusted data as a
tolerance parameter in GIS functions and aggregates on Oracle until a patch is applied.Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Django
Ubuntu