CVE-2020-7471: SQL Injection
Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 2:2.2.10-1Fixed in 1:1.11.28-1~deb10u1Fixed in 1:1.10.7-2+deb9u8 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 3.0.3 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 2.2.10 - Upgrade
Upgrade
pip/djangoto a version that resolves this vulnerability.Fixed in 1.11.28 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 2:2.2.28-1~deb11u2Fixed in 3:3.2.19-1+deb12u1Fixed in 3:4.2.16-1 - Upgrade
Upgrade
Django StringAgg (contrib.postgres.aggregates.StringAgg)to a version that resolves this vulnerability.Fixed in 1.11.28 - Upgrade
Upgrade
Django StringAgg (contrib.postgres.aggregates.StringAgg)to a version that resolves this vulnerability.Fixed in 2.2.10 - Upgrade
Upgrade
Django StringAgg (contrib.postgres.aggregates.StringAgg)to a version that resolves this vulnerability.Fixed in 3.0.3
Event History
Frequently Asked Questions
What is the severity of CVE-2020-7471?
The severity of CVE-2020-7471 is critical with a CVSS score of 9.8.
How does CVE-2020-7471 affect Django versions?
CVE-2020-7471 affects Django versions 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3.
What is the vulnerability in CVE-2020-7471?
The vulnerability in CVE-2020-7471 is SQL Injection if untrusted data is used as a StringAgg delimiter.
How can I fix CVE-2020-7471?
To fix CVE-2020-7471, update Django to version 3.0.3, 2.2.10, or 1.11.28 depending on the version you are using.
Where can I find more information about CVE-2020-7471?
You can find more information about CVE-2020-7471 in the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-7471), [GitHub](https://github.com/django/django/commit/eb31d845323618d688ad429479c6dda973056136), [Google Groups](https://groups.google.com/forum/#!topic/django-announce/X45S86X5bZI).