Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Ubuntu 19.10, 18.04 LTS, 16.04 LTS: USN-4296-1 Critical Django Database

ubuntu
Calendar Grey March 4, 2020
Dist Ubuntu Esm H88
Ubuntu Security Announcement USN-4296-1 addresses a flaw in Django that allows unauthorized database access. Immediate update recommended.
Django could allow unintended access to the database.

Summary

Django could allow unintended access to the database.

Software Description:

- python-django: High-level Python web development framework

Details:

Norbert Szetei discovered that Django incorrectly handled the GIS functions

and aggregates on Oracle. A remote attacker could possibly use this issue

to perform an SQL injection attack.

Topics%20covered

Topics Covered

security advisory Ubuntu SQL injection database access python-django

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.10:
  python-django                   1:1.11.22-1ubuntu1.3
  python3-django                  1:1.11.22-1ubuntu1.3

Ubuntu 18.04 LTS:
  python-django                   1:1.11.11-1ubuntu1.8
  python3-django                  1:1.11.11-1ubuntu1.8

Ubuntu 16.04 LTS:
  python-django                   1.8.7-1ubuntu5.12
  python3-django                  1.8.7-1ubuntu5.12

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4296-1

CVE-2020-9402

Severity
critical
Lowest
Low
Medium
High
Critical

March 04, 2020

Topics%20covered

Topics Covered

security advisory Ubuntu SQL injection database access python-django

Package Information

https://launchpad.net/ubuntu/+source/python-django/1:1.11.22-1ubuntu1.3
https://launchpad.net/ubuntu/+source/python-django/1:1.11.11-1ubuntu1.8
https://launchpad.net/ubuntu/+source/python-django/1.8.7-1ubuntu5.12

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here