SQL Injection Vulnerability in Django Packages: CVE-2020-9402
Summary
ALPINE-CVE-2020-9402: Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. Affects py-django versions < 1.11.29-r0. Fixed in 1.11.29-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features, including an ORM, authentication, and an admin interface. The vulnerability in question affects specific versions of Django, particularly those prior to 1.11.29, 2.2.11, and 3.0.4, which are susceptible to SQL injection attacks when untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle databases.
Vulnerability Detail
The vulnerability, identified as CVE-2020-9402, allows for SQL injection if untrusted data is passed as a tolerance parameter in GIS functions and aggregates on Oracle. This flaw can lead to the execution of malicious SQL commands, potentially compromising the integrity and confidentiality of the database. The issue arises from improper handling of input data, which can break escaping mechanisms, allowing attackers to manipulate SQL queries.
How To Fix
Minimum fixed version
1.11.29-r0
This is the first release that contains the fix.
sudo apk add --upgrade py-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using untrusted data as tolerance parameters in GIS functions and aggregates on Oracle until the package can be updated. Implement input validation to sanitize user inputs and prevent SQL injection.
Conclusion
CVE-2020-9402 presents a significant risk to applications using vulnerable versions of Django, particularly in scenarios involving GIS functions with Oracle databases. It is crucial to update to the patched versions to mitigate the risk of SQL injection attacks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for py-django →
FAQ
CVE-2020-9402 is a vulnerability in Django that allows SQL injection through untrusted data in GIS functions and aggregates on Oracle.
Django versions prior to 1.11.29, 2.2.11, and 3.0.4 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2020-9402 is 8.8, indicating a high severity level.
If immediate updating is not possible, implement input validation and avoid using untrusted data in GIS functions as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for py-django.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
