DemoBook a demo

Vulnerability advisory

CVE-2020-9402

Published Updated OSV record ↗

Also known as BIT-django-2020-9402GHSA-3gh2-xw74-jmcwPYSEC-2020-36

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/django/django ↗
c669cf279ae7b3e02a61db4fb077030a4db80e4f to before f1e3017aeaeddc590dcf2cf88511f3a726da73caf1e3017aeaeddc590dcf2cf88511f3a726da73ca
2a62cdcfec85938f40abb2e9e6a9ff497e02afe8 to before 167699278806b21757104acf0ff0570f673d44c7167699278806b21757104acf0ff0570f673d44c7
2a04e24d2dfc8e60a66e4369d970913cb2112d91 to before c2250cfb80e27cdf8d098428824da2800a18cadfc2250cfb80e27cdf8d098428824da2800a18cadf

Description

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.