Lucene search

K

GoogleOSV:PYSEC-2020-36

HistoryMar 05, 2020 - 3:15 p.m.

PYSEC-2020-36

2020-03-0515:15:00

Google

osv.dev

22

0.14 Low

EPSS

Percentile

95.7%

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

CPENameOperatorVersion
djangoeq1.11.12
djangoeq1.11.15
djangoeq2.2.3
djangoeq2.2.5
djangoeq3.0
djangoeq1.11.3
djangoeq1.11.27
djangoeq1.11.5
djangoeq2.2
djangoeq1.11

Rows per page:

1-10 of 431

References

docs.djangoproject.com/en/3.0/releases/security/

github.com/advisories/GHSA-3gh2-xw74-jmcw

groups.google.com/forum/#!topic/django-announce/fLUh_pOaKrY

lists.fedoraproject.org/archives/list/[email protected]/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/

security.gentoo.org/glsa/202004-17

security.netapp.com/advisory/ntap-20200327-0004/

usn.ubuntu.com/4296-1/

www.debian.org/security/2020/dsa-4705

www.djangoproject.com/weblog/2020/mar/04/security-releases/

0.14 Low

EPSS

Percentile

95.7%

Related for OSV:PYSEC-2020-36

openvas6 nessus8 nuclei1 osv4 cve1 prion1 nvd1 ubuntu1 redhatcve1 debiancve1 debian3 archlinux1 veracode1 alpinelinux1 github1 freebsd1 ubuntucve1 cvelist1 altlinux2 fedora2 gentoo1 redhat1