Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.

- Security fix for CVE-2020-7471.

  - Security fix for CVE-2020-9402.

  - Security fix for CVE-2020-13254.

  - Security fix for CVE-2020-13596.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202004-17 (Django: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Django. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by sending specially crafted input, could possibly       cause a Denial of Service condition, or alter the database.
  Workaround :

    There is no known workaround at this time.

Simon Charette discovered that Django, a high-level Python web development framework, did not properly handle input in its PostgreSQL module. A remote attacker could leverage this to perform SQL injection attacks.

MITRE CVE reports :

Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4264-1 advisory.

    Simon Charette discovered that Django incorrectly handled input in the PostgreSQL module. A remote     attacker could possibly use this to perform SQL injection attacks.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
137686	Fedora 32 : python-django (2020-c2639662af)	Nessus	Fedora Local Security Checks	critical
137680	Fedora 31 : python-django (2020-2e7d30f7aa)	Nessus	Fedora Local Security Checks	critical
136216	GLSA-202004-17 : Django: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
133816	Debian DSA-4629-1 : python-django - security update	Nessus	Debian Local Security Checks	critical
133476	FreeBSD : Django -- potential SQL injection vulnerability (5a45649a-4777-11ea-bdec-08002728f74c)	Nessus	FreeBSD Local Security Checks	critical
133450	Ubuntu 18.04 LTS : Django vulnerability (USN-4264-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2020-7471

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical