Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-py-djangoalpine-linux-upgrade-py3-django | Mar 11, 2020 | Mar 5, 2020 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Mar 5, 2020 | |
| Debian | debian-upgrade-python-django | May 27, 2022 | Mar 5, 2020 | |
| Freebsd | freebsd-upgrade-package-py27-django111freebsd-upgrade-package-py35-django111freebsd-upgrade-package-py36-django111freebsd-upgrade-package-py37-django111freebsd-upgrade-package-py38-django111freebsd-upgrade-package-py35-django22freebsd-upgrade-package-py36-django22freebsd-upgrade-package-py37-django22freebsd-upgrade-package-py38-django22freebsd-upgrade-package-py36-django30freebsd-upgrade-package-py37-django30freebsd-upgrade-package-py38-django30 | Mar 12, 2020 | Mar 12, 2020 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-python-django | May 1, 2020 | Mar 5, 2020 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-legacy-library-python-django-27-1-11-29-11-4-21-0-1-69-0oracle-solaris-11-4-upgrade-legacy-library-python-django-34-1-11-29-11-4-21-0-1-69-0oracle-solaris-11-4-upgrade-legacy-library-python-django-35-1-11-29-11-4-21-0-1-69-0oracle-solaris-11-4-upgrade-library-python-2-django-1-4-10-11-4-0-0-1-9-0oracle-solaris-11-4-upgrade-library-python-2-django-26-1-4-22-11-4-0-0-0-13-0oracle-solaris-11-4-upgrade-library-python-2-django-27-1-4-10-11-4-0-0-1-9-0oracle-solaris-11-4-upgrade-library-python-django-1-11-29-11-4-21-0-1-69-0oracle-solaris-11-4-upgrade-library-python-django-26-1-4-22-11-4-0-0-1-9-0oracle-solaris-11-4-upgrade-library-python-django-27-1-11-29-11-4-21-0-1-69-0oracle-solaris-11-4-upgrade-library-python-django-34-1-11-29-11-4-21-0-1-69-0oracle-solaris-11-4-upgrade-library-python-django-35-1-11-29-11-4-21-0-1-69-0oracle-solaris-11-4-upgrade-library-python-django-37-1-11-29-11-4-21-0-1-69-0 | Jan 19, 2021 | Mar 5, 2020 | |
| Ubuntu | ubuntu-upgrade-python-djangoubuntu-upgrade-python3-django | Mar 5, 2020 | Mar 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub