Skip to content
OpenAdvisories
High USN-4296-1 1 CVE

python-django vulnerability

Published Mar 4, 2020 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Norbert Szetei discovered that Django incorrectly handled the GIS functions
and aggregates on Oracle. A remote attacker could possibly use this issue
to perform an SQL injection attack.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS python-django 1.8.7-1ubuntu5.12
Ubuntu · 18.04 LTS 18.04:LTS python-django 1:1.11.11-1ubuntu1.8

Vulnerabilities 1

  • High 8.8
    CVE-2020-9402 EPSS 24%

    SQL injection in Django

    Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on O…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI

References

  • report
    https://ubuntu.com/security/CVE-2020-9402