Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection…
Priority MEDIUM 58CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 8 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-89.
Summary
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.
Why it matters now
EPSS 0.22513 97th percentileScored 2026-11-07
Fix Partial Django (PyPI): 1.11.29, 2.2.11, 3.0.4Red Hat: 1 advisoryRed Hat: 2 fixed, 8 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | Django (PyPI) | 1.11 to before 1.11.29 | 1.11.29 | Patch available | GHSA-3gh2-xw74-jmcw |
| — | Django (PyPI) | 2.2 to before 2.2.11 | 2.2.11 | Patch available | GHSA-3gh2-xw74-jmcw |
| — | Django (PyPI) | 3.0 to before 3.0.4 | 3.0.4 | Patch available | GHSA-3gh2-xw74-jmcw |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- Django (PyPI) Vendor— Affected 1.11 to before 1.11.29 Fixed in 1.11.29 Patch available GHSA-3gh2-xw74-jmcw
- Django (PyPI) Vendor— Affected 2.2 to before 2.2.11 Fixed in 2.2.11 Patch available GHSA-3gh2-xw74-jmcw
- Django (PyPI) Vendor— Affected 3.0 to before 3.0.4 Fixed in 3.0.4 Patch available GHSA-3gh2-xw74-jmcw
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* | 1.11 to before 1.11.29; 2.2 to before 2.2.11; 3.0 to before 3.0.4 | Vulnerable | djangoproject |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* | 19.10 | Vulnerable | Canonical |
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions 1.11 to before 1.11.29; 2.2 to before 2.2.11; 3.0 to before 3.0.4 Vulnerable ·djangoproject
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* Versions 19.10 Vulnerable ·Canonical
Remediation
- Fix · GHSA-3gh2-xw74-jmcw Django (PyPI) Fixed in 1.11.29 Advisory →
- Fix · GHSA-3gh2-xw74-jmcw Django (PyPI) Fixed in 2.2.11 Advisory →
- Fix · GHSA-3gh2-xw74-jmcw Django (PyPI) Fixed in 3.0.4 Advisory →
Red Hat 1 advisory
- RHSA-2021:1313 Released 2021-04-21 · Red Hat rating ModerateSatellite 6.9 Release
- Red Hat Satellite 6.9 ansible-collection-redhat-satellite-2.0.1-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.1.0-1.el7sat +47
- Red Hat Satellite Capsule 6.9 ansible-collection-redhat-satellite-2.0.1-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.1.0-1.el7sat +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 2 | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 15 (Stein) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16 (Train) | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix yet: Fix deferred |
| Red Hat Update Infrastructure 3 for Cloud Providers | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6.9 | Fixed | RHSA-2021:1313 |
| Red Hat Satellite Capsule 6.9 | Fixed | RHSA-2021:1313 |
Not affected: 2 products
- Red Hat Satellite 6.9
- Red Hat Satellite Capsule 6.9
Timeline
- 2026-10-02 Threatist record created from CVE-2020-9402
- 2026-10-03 Alias added: GHSA-3gh2-xw74-jmcw
References
Patch 2
Advisory 9
- USN-4296-1
- https://security.netapp.com/advisory/ntap-20200327-0004/
- GLSA-202004-17
- DSA-4705
- FEDORA-2020-c2639662af
- FEDORA-2020-2e7d30f7aa
- [debian-lts-announce] 20220526 [SECURITY] [DLA 3024-1] python-django security update
- https://nvd.nist.gov/vuln/detail/CVE-2020-9402
- https://github.com/advisories/GHSA-3gh2-xw74-jmcw
Other 14
- https://groups.google.com/forum/#%21topic/django-announce/fLUh_pOaKrY
- https://github.com/django/django/commit/6695d29b1c1ce979725816295a26ecc64ae0e927
- https://www.djangoproject.com/weblog/2020/mar/04/security-releases
- https://usn.ubuntu.com/4296-1
- https://security.netapp.com/advisory/ntap-20200327-0004
- https://lists.fedoraproject.org/archives/list/[email protected]/message/UZMN2NKAGTFE3YKMNM2JVJG7R2W7LLHY
- https://lists.fedoraproject.org/archives/list/[email protected]/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZMN2NKAGTFE3YKMNM2JVJG7R2W7LLHY
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ
- https://groups.google.com/forum/#!topic/django-announce/fLUh_pOaKrY
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2020-36.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2020-345.yaml
- https://github.com/django/django
- https://docs.djangoproject.com/en/3.0/releases/security
Sources
- CVE-2020-9402 · CVE Program
- CVE-2020-9402 · NVD
- FIRST EPSS
- GHSA-3gh2-xw74-jmcw · GitHub Advisory Database · CC BY 4.0
- CVE-2020-9402 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences