CVE-2020-9402

Description

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

How to fix CVE-2020-9402

To remediate CVE-2020-9402, upgrade the affected package to a fixed version below.

• —upgrade to 1.11.29-r0 or later
• —upgrade to 1.11.29-r0 or later
• —upgrade to 1.11.29 or later
• —upgrade to 1:1.10.7-2+deb9u17 or later
• —upgrade to 2:2.2.11-1 or later
• —upgrade to 1.11.29 or later
• —upgrade to 1.11.29 or later
• —upgrade to 1.11.29 or later

Is CVE-2020-9402 being exploited?

Likely — EPSS is 85.0%, placing CVE-2020-9402 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (8)

• from 0, < 1.11.29-r0
• from 0, < 1.11.29-r0
• >= 1.11.0, < 1.11.29, >= 2.2.0, < 2.2.11, >= 3.0.0, < 3.0.4
• from 0, < 1:1.10.7-2+deb9u17
• from 0, < 2:2.2.11-1
• >= 1.11, < 1.11.29
• >= 1.11, < 1.11.29, >= 2.2, < 2.2.11, >= 3.0, < 3.0.4
• >= 1.11, < 1.11.29, >= 2.2, < 2.2.11, >= 3.0, < 3.0.4

CVSS scores

References (28)

• ADVISORYgithub.com/advisories/GHSA-3gh2-xw74-jmcw
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-9402
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2020-9402
• ADVISORYsecurity.netapp.com/advisory/ntap-20200327-0004/
• ADVISORY