Is CVE-2020-9402 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-9402 being exploited in the wild.

How severe is CVE-2020-9402?

High severity, with a CVSS score of 8.8, published 5 June 2020.

Which products and versions are affected?

Django (PyPI) ECOSYSTEM:introduced=1.11,fixed=1.11.29, ECOSYSTEM:introduced=1.11,fixed=1.11.29,introduced=2.2,fixed=2.2.11,introduced=3.0,fixed=3.0.4.

Is there a fix for CVE-2020-9402?

Yes. Django (PyPI): upgrade to 1.11.29, 3.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-9402 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-9402?

Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-9402: Django SQL injection in GIS functions for Oracle

CVE-2020-9402 · Severity: high · CVSS 8.8 · Published 2020-06-05

Django, a popular web framework, is vulnerable to a security flaw when used with Oracle databases. An attacker could exploit this to run unauthorized database commands, potentially leading to the theft of sensitive customer data or the modification of records. This issue specifically affects applications using geographic information system (GIS) features.

Technologies: Django (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2020-9402 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-9402 being exploited in the wild.
How severe is CVE-2020-9402?: High severity, with a CVSS score of 8.8, published 5 June 2020.
Which products and versions are affected?: Django (PyPI) ECOSYSTEM:introduced=1.11,fixed=1.11.29, ECOSYSTEM:introduced=1.11,fixed=1.11.29,introduced=2.2,fixed=2.2.11,introduced=3.0,fixed=3.0.4.
Is there a fix for CVE-2020-9402?: Yes. Django (PyPI): upgrade to 1.11.29, 3.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-9402 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-9402?: Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Django (PyPI): upgrade to 1.11.29, 3.0.4 or later
```
pip install "Django>=3.0.4"
```

Technical details

A SQL injection vulnerability exists in Django's Oracle database backend. The root cause is improper neutralization of the 'tolerance' parameter within Geographic Information System (GIS) functions and aggregates. An attacker with low privileges can provide a specially crafted tolerance value to break out of SQL escaping and execute arbitrary SQL commands. This affects Django versions 1.11.x before 1.11.29, 2.2.x before 2.2.11, and 3.0.x before 3.0.4. Patches are available in versions 1.11.29, 2.2.11, and 3.0.4.

Affected products

Django Django >= 1.11, < 1.11.29; >= 2.2, < 2.2.11; >= 3.0, < 3.0.4

Identifiers

CVE-2020-9402
GHSA-3gh2-xw74-jmcw
PYSEC-2020-345
PYSEC-2020-36

Timeline

2020-03-04: advisory: Django security release announcement
2020-03-05: disclosed: NVD publication date
2020-06-05: other: GitHub Advisory Database publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.