Описание
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.
A SQL-injection flaw was found in python-django, where GIS functions and aggregates in Oracle did not correctly neutralize tolerance-parameter data. A remote attacker could use this flaw to submit crafted data to inject malicious SQL.
Отчет
Although the following products ship the flawed code, they do not use or support its functionality and therefore will not be updated:
- Red Hat OpenStack Platform
- Red Hat Update Infrastructure 3
- Red Hat Ceph Storage The following products will be updated. However, because both products do not use the functionality, their Impact has been reduced to 'Low':
- Red Hat Gluster Storage
- Red Hat Satellite 6
Меры по смягчению последствий
There is no known mitigation for this issue, the flaw can only be resolved by applying updates.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ceph Storage 2 | python-django | Will not fix | ||
| Red Hat Ceph Storage 3 | python-django | Will not fix | ||
| Red Hat OpenStack Platform 10 (Newton) | python-django | Will not fix | ||
| Red Hat OpenStack Platform 13 (Queens) | python-django | Will not fix | ||
| Red Hat OpenStack Platform 15 (Stein) | python-django | Will not fix | ||
| Red Hat OpenStack Platform 16 (Train) | python-django | Will not fix | ||
| Red Hat Storage 3 | python-django | Affected | ||
| Red Hat Update Infrastructure 3 for Cloud Providers | python-django | Fix deferred | ||
| Red Hat Satellite 6.9 for RHEL 7 | pulp | Fixed | RHSA-2021:1313 | 21.04.2021 |
| Red Hat Satellite 6.9 for RHEL 7 | python-django | Fixed | RHSA-2021:1313 | 21.04.2021 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.
Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 al ...
Уязвимость библиотеки Django для языка программирования Python, позволяющая нарушителю выполнить произвольный код
EPSS
8.8 High
CVSS3