CVE-2020-9402

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2020-9402

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-9402.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-9402

Aliases

Related

Published

2020-03-05T15:15:12Z

Modified

2024-08-01T09:19:47.846348Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

References

Affected packages

Alpine:v3.10 / py-django

Package

Name: py-django
Purl: pkg:apk/alpine/py-django?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.29-r0

Affected versions

1.*

1.2.5-r0

1.2.5-r1

1.4.1-r0

1.5-r0

1.5.1-r0

1.5.5-r0

1.5.6-r0

1.5.7-r0

1.5.8-r0

1.6.5-r0

1.6.6-r0

1.7-r0

1.8-r0

1.8.3-r0

1.8.4-r0

1.8.6-r0

1.8.7-r0

1.8.8-r0

1.8.10-r0

1.8.12-r0

1.8.14-r0

1.8.15-r0

1.8.16-r0

1.10.5-r0

1.10.7-r0

1.11-r0

1.11-r1

1.11.5-r0

1.11.9-r0

1.11.10-r0

1.11.11-r0

1.11.12-r0

1.11.13-r0

1.11.15-r0

1.11.18-r0

1.11.20-r0

1.11.20-r1

1.11.21-r0

1.11.22-r0

1.11.23-r0

1.11.27-r0

1.11.28-r0

Alpine:v3.11 / py3-django

Package

Name: py3-django
Purl: pkg:apk/alpine/py3-django?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.29-r0

Affected versions

1.*

1.2.5-r0

1.2.5-r1

1.4.1-r0

1.5-r0

1.5.1-r0

1.5.5-r0

1.5.6-r0

1.5.7-r0

1.5.8-r0

1.6.5-r0

1.6.6-r0

1.7-r0

1.8-r0

1.8.3-r0

1.8.4-r0

1.8.6-r0

1.8.7-r0

1.8.8-r0

1.8.10-r0

1.8.12-r0

1.8.14-r0

1.8.15-r0

1.8.16-r0

1.10.5-r0

1.10.7-r0

1.11-r0

1.11-r1

1.11.5-r0

1.11.9-r0

1.11.10-r0

1.11.11-r0

1.11.12-r0

1.11.13-r0

1.11.15-r0

1.11.18-r0

1.11.20-r0

1.11.20-r1

1.11.21-r0

1.11.22-r0

1.11.23-r0

1.11.23-r1

1.11.23-r2

1.11.27-r0

1.11.28-r0

Alpine:v3.12 / py3-django

Package

Name: py3-django
Purl: pkg:apk/alpine/py3-django?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.29-r0

Affected versions

1.*

1.2.5-r0

1.2.5-r1

1.4.1-r0

1.5-r0

1.5.1-r0

1.5.5-r0

1.5.6-r0

1.5.7-r0

1.5.8-r0

1.6.5-r0

1.6.6-r0

1.7-r0

1.8-r0

1.8.3-r0

1.8.4-r0

1.8.6-r0

1.8.7-r0

1.8.8-r0

1.8.10-r0

1.8.12-r0

1.8.14-r0

1.8.15-r0

1.8.16-r0

1.10.5-r0

1.10.7-r0

1.11-r0

1.11-r1

1.11.5-r0

1.11.9-r0

1.11.10-r0

1.11.11-r0

1.11.12-r0

1.11.13-r0

1.11.15-r0

1.11.18-r0

1.11.20-r0

1.11.20-r1

1.11.21-r0

1.11.22-r0

1.11.23-r0

1.11.23-r1

1.11.23-r2

1.11.27-r0

1.11.28-r0

Alpine:v3.8 / py-django

Package

Name: py-django
Purl: pkg:apk/alpine/py-django?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.29-r0

Affected versions

1.*

1.2.5-r0

1.2.5-r1

1.4.1-r0

1.5-r0

1.5.1-r0

1.5.5-r0

1.5.6-r0

1.5.7-r0

1.5.8-r0

1.6.5-r0

1.6.6-r0

1.7-r0

1.8-r0

1.8.3-r0

1.8.4-r0

1.8.6-r0

1.8.7-r0

1.8.8-r0

1.8.10-r0

1.8.12-r0

1.8.14-r0

1.8.15-r0

1.8.16-r0

1.10.5-r0

1.10.7-r0

1.11-r0

1.11-r1

1.11.5-r0

1.11.9-r0

1.11.10-r0

1.11.11-r0

1.11.12-r0

1.11.13-r0

1.11.15-r0

1.11.18-r0

1.11.20-r0

1.11.21-r0

1.11.22-r0

1.11.23-r0

1.11.27-r0

1.11.28-r0

Alpine:v3.9 / py-django

Package

Name: py-django
Purl: pkg:apk/alpine/py-django?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.29-r0

Affected versions

1.*

1.2.5-r0

1.2.5-r1

1.4.1-r0

1.5-r0

1.5.1-r0

1.5.5-r0

1.5.6-r0

1.5.7-r0

1.5.8-r0

1.6.5-r0

1.6.6-r0

1.7-r0

1.8-r0

1.8.3-r0

1.8.4-r0

1.8.6-r0

1.8.7-r0

1.8.8-r0

1.8.10-r0

1.8.12-r0

1.8.14-r0

1.8.15-r0

1.8.16-r0

1.10.5-r0

1.10.7-r0

1.11-r0

1.11-r1

1.11.5-r0

1.11.9-r0

1.11.10-r0

1.11.11-r0

1.11.12-r0

1.11.13-r0

1.11.15-r0

1.11.18-r0

1.11.20-r0

1.11.21-r0

1.11.22-r0

1.11.23-r0

1.11.27-r0

1.11.28-r0

Debian:11 / python-django

Package

Name: python-django
Purl: pkg:deb/debian/python-django?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2:2.2.11-1

Ecosystem specific

{
    "urgency": "low"
}

Debian:12 / python-django

Package

Name: python-django
Purl: pkg:deb/debian/python-django?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2:2.2.11-1

Ecosystem specific

{
    "urgency": "low"
}

Debian:13 / python-django

Package

Name: python-django
Purl: pkg:deb/debian/python-django?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2:2.2.11-1

Ecosystem specific

{
    "urgency": "low"
}

Git / github.com/django/django

Affected ranges

Type: GIT
Repo: https://github.com/django/django
Events: Introduced

58f02c498b659a906e9c30d946bd89bedc4717e5

Fixed

f1e3017aeaeddc590dcf2cf88511f3a726da73ca

Affected versions

1.*

1.11

1.11.1

1.11.10

1.11.11

1.11.12

1.11.13

1.11.14

1.11.15

1.11.16

1.11.17

1.11.18

1.11.19

1.11.2

1.11.20

1.11.21

1.11.22

1.11.23

1.11.24

1.11.25

1.11.26

1.11.27

1.11.28

1.11.3

1.11.4

1.11.5

1.11.6

1.11.7

1.11.8

1.11.9