CVE-2020-9402

2020-03-0515:15:00

Alpine Linux Development Team

security.alpinelinux.org

0.141 Low

EPSS

Percentile

95.7%

JSON

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

OSVersionArchitecturePackageVersionFilename
Alpineedge-communitynoarchpy3-django< 1.11.29-r0UNKNOWN
Alpine3.10-mainnoarchpy-django< 1.11.29-r0UNKNOWN
Alpine3.11-mainnoarchpy3-django< 1.11.29-r0UNKNOWN
Alpine3.12-mainnoarchpy3-django< 1.11.29-r0UNKNOWN
Alpine3.13-communitynoarchpy3-django< 1.11.29-r0UNKNOWN
Alpine3.14-communitynoarchpy3-django< 1.11.29-r0UNKNOWN
Alpine3.15-communitynoarchpy3-django< 1.11.29-r0UNKNOWN
Alpine3.16-communitynoarchpy3-django< 1.11.29-r0UNKNOWN
Alpine3.17-communitynoarchpy3-django< 1.11.29-r0UNKNOWN
Alpine3.18-communitynoarchpy3-django< 1.11.29-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	edge-community	noarch	py3-django	< 1.11.29-r0	UNKNOWN
Alpine	3.10-main	noarch	py-django	< 1.11.29-r0	UNKNOWN
Alpine	3.11-main	noarch	py3-django	< 1.11.29-r0	UNKNOWN
Alpine	3.12-main	noarch	py3-django	< 1.11.29-r0	UNKNOWN
Alpine	3.13-community	noarch	py3-django	< 1.11.29-r0	UNKNOWN
Alpine	3.14-community	noarch	py3-django	< 1.11.29-r0	UNKNOWN
Alpine	3.15-community	noarch	py3-django	< 1.11.29-r0	UNKNOWN
Alpine	3.16-community	noarch	py3-django	< 1.11.29-r0	UNKNOWN
Alpine	3.17-community	noarch	py3-django	< 1.11.29-r0	UNKNOWN
Alpine	3.18-community	noarch	py3-django	< 1.11.29-r0	UNKNOWN