ALPINE-CVE-2020-9402
- Source
- https://security.alpinelinux.org/vuln/CVE-2020-9402
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/alpine/ALPINE-CVE-2020-9402.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/ALPINE-CVE-2020-9402
- Upstream
- Published
- 2020-03-05T15:15:12.410Z
- Modified
- 2026-06-15T18:26:56.695909388Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.
- References
Affected packages
Alpine:v3.10 / py-django
Package
- Name
- py-django
- Purl
- pkg:apk/alpine/py-django?arch=source
Alpine:v3.8 / py-django
Package
- Name
- py-django
- Purl
- pkg:apk/alpine/py-django?arch=source
Alpine:v3.9 / py-django
Package
- Name
- py-django
- Purl
- pkg:apk/alpine/py-django?arch=source
Alpine:v3.11 / py3-django
Package
- Name
- py3-django
- Purl
- pkg:apk/alpine/py3-django?arch=source