CVE-2020-7471

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.

References

Affected packages

Git / github.com/django/django

Affected ranges

Type

GIT

Repo

https://github.com/django/django

Events

Introduced

c669cf279ae7b3e02a61db4fb077030a4db80e4f

Fixed

e09f09b965ef47ffd99abd2c26ba7416751cffa6

Introduced

2a62cdcfec85938f40abb2e9e6a9ff497e02afe8

Fixed

b2c33a57b3b98f1e90bbc2a2be2c5a6d814eed29

Introduced

2a04e24d2dfc8e60a66e4369d970913cb2112d91

Fixed

c459a4661b2e96b53d3784c76e1fd5651b8cdc4a

Fixed

eb31d845323618d688ad429479c6dda973056136

Database specific

{
    "cpe": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.11"
        },
        {
            "fixed": "1.11.28"
        },
        {
            "introduced": "2.2"
        },
        {
            "fixed": "2.2.10"
        },
        {
            "introduced": "3.0"
        },
        {
            "fixed": "3.0.3"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-7471.json"