Bug 711624

Summary:	dev-python/django: SQL injection (Oracle) on untrusted data in GIS functions (via 'tolerance') (CVE-2020-9402)
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	minor	CC:	python
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://www.djangoproject.com/weblog/2020/mar/04/security-releases/
Whiteboard:	C3 [ebuild]
Package list:		Runtime testing required:	---

Description Sam James archtester

2020-03-05 18:30:17 UTC

Description:
"Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL."

Comment 1 Agostino Sarubbo gentoo-dev

2020-03-06 07:36:17 UTC


*** This bug has been marked as a duplicate of bug 711522 ***