crítica
CVE-2020-7471
django: potential SQL injection via StringAgg(delimiter)
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, GHSA, Bitnami. Más baja según Red Hat (alta), Ubuntu (media).
Descripción
Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | django | 1.11.28, 2.2.10, 3.0.3 |
| pip::GitHub Security Advisory pip | django | 1.11.28, 2.2.10, 3.0.3 |
| alpine 3.10 | py-django | 1.11.28-r0 |
| alpine 3.11 | py3-django | 1.11.28-r0 |
| alpine 3.12 | py3-django | 1.11.28-r0 |
| alpine 3.13 | py3-django | 1.11.28-r0 |
| alpine 3.14 | py3-django | 1.11.28-r0 |
| alpine 3.15 | py3-django | 1.11.28-r0 |
| alpine 3.16 | py3-django | 1.11.28-r0 |
| alpine 3.17 | py3-django | 1.11.28-r0 |
| alpine 3.18 | py3-django | 1.11.28-r0 |
| alpine 3.19 | py3-django | 1.11.28-r0 |
Mostrar las 36 entradas de 31 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | django | 1.11.28, 2.2.10, 3.0.3 |
| pip::GitHub Security Advisory pip | django | 1.11.28, 2.2.10, 3.0.3 |
| alpine 3.10 | py-django | 1.11.28-r0 |
| alpine 3.11 | py3-django | 1.11.28-r0 |
| alpine 3.12 | py3-django | 1.11.28-r0 |
| alpine 3.13 | py3-django | 1.11.28-r0 |
| alpine 3.14 | py3-django | 1.11.28-r0 |
| alpine 3.15 | py3-django | 1.11.28-r0 |
| alpine 3.16 | py3-django | 1.11.28-r0 |
| alpine 3.17 | py3-django | 1.11.28-r0 |
| alpine 3.18 | py3-django | 1.11.28-r0 |
| alpine 3.19 | py3-django | 1.11.28-r0 |
| alpine 3.20 | py3-django | 1.11.28-r0 |
| alpine 3.21 | py3-django | 1.11.28-r0 |
| alpine 3.22 | py3-django | 1.11.28-r0 |
| alpine 3.23 | py3-django | 1.11.28-r0 |
| alpine 3.24 | py3-django | 1.11.28-r0 |
| alpine 3.8 | py-django | 1.11.28-r0 |
| alpine 3.9 | py-django | 1.11.28-r0 |
| alpine edge | py3-django | 1.11.28-r0 |
| debian 10 | python-django | 1:1.11.28-1~deb10u1 |
| debian 11 | python-django | 2:2.2.10-1 |
| debian 12 | python-django | 2:2.2.10-1 |
| debian 13 | python-django | 2:2.2.10-1 |
| debian 14 | python-django | 2:2.2.10-1 |
| debian 9 | python-django | 1:1.10.7-2+deb9u8 |
| echo | python-django | 2:2.2.10-1 |
| Red Hat | python-django | sin corrección indicada |
| Red Hat | python-django-bash-completion | sin corrección indicada |
| Red Hat | python-django-doc | sin corrección indicada |
| Red Hat | python2-django | sin corrección indicada |
| Red Hat | python2-django-doc | sin corrección indicada |
| Red Hat | python3-django | sin corrección indicada |
| ubuntu 18.04 | python-django | 1:1.11.11-1ubuntu1.7 |
| ubuntu 18.04-ESM | python-django | 1:1.11.11-1ubuntu1.7 |
| ubuntu 19.10 | python-django | 1:1.11.22-1ubuntu1.2 |
Referencias
- http://www.openwall.com/lists/oss-security/2020/02/03/1
- https://access.redhat.com/security/cve/CVE-2020-7471
- https://docs.djangoproject.com/en/3.0/releases/security
- https://docs.djangoproject.com/en/3.0/releases/security/
- https://github.com/advisories/GHSA-hmr4-m2h5-33qx
- https://github.com/django/django
- https://github.com/django/django/commit/001b0634cd309e372edb6d7d95d083d02b8e37bd
- https://github.com/django/django/commit/505826b469b16ab36693360da9e11fd13213421b
Las 28 referencias
- https://github.com/django/django/commit/c67a368c16e4680b324b4f385398d638db4d8147
- https://github.com/django/django/commit/eb31d845323618d688ad429479c6dda973056136
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2020-35.yaml
- https://groups.google.com/forum/#!topic/django-announce/X45S86X5bZI
- https://groups.google.com/forum/#%21topic/django-announce/X45S86X5bZI
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4A2AP4T7RKPBCLTI2NNQG3T6MINDUUMZ/
- https://nvd.nist.gov/vuln/detail/CVE-2020-7471
- https://seclists.org/bugtraq/2020/Feb/30
- https://security.gentoo.org/glsa/202004-17
- https://security.netapp.com/advisory/ntap-20200221-0006
- https://security.netapp.com/advisory/ntap-20200221-0006/
- https://ubuntu.com/security/notices/USN-4264-1
- https://usn.ubuntu.com/4264-1
- https://usn.ubuntu.com/4264-1/
- https://www.cve.org/CVERecord?id=CVE-2020-7471
- https://www.debian.org/security/2020/dsa-4629
- https://www.djangoproject.com/weblog/2020/feb/03/security-releases
- https://www.djangoproject.com/weblog/2020/feb/03/security-releases/
- https://www.openwall.com/lists/oss-security/2020/02/03/1