漏洞描述
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allow SQL injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it is possible to break character escaping and inject malicious SQL.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.debian.orghttps://www.debian.org/security/2020/dsa-4705↗github.comhttps://github.com/vulhub/vulhub/tree/master/django/CVE-2020-9402↗docs.djangoproject.comhttps://docs.djangoproject.com/en/3.0/releases/security/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2020-9402↗groups.google.comhttps://groups.google.com/forum/#!topic/django-announce/fLUh_pOaKrY↗