test0908
/
django
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
django/docs/releases/1.11.29.txt

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

14 lines
485 B
Plaintext
Raw Normal View History

Fixed CVE-2020-9402 -- Properly escaped tolerance parameter in GIS functions and aggregates on Oracle. Thanks to Norbert Szetei for the report.
2020-02-24 21:46:28 +08:00
============================
Django 1.11.29 release notes
============================
*March 4, 2020*
Fixed typo in docs/releases/1.11.29.txt.
2020-03-04 17:46:43 +08:00
Django 1.11.29 fixes a security issue in 1.11.28.
Fixed CVE-2020-9402 -- Properly escaped tolerance parameter in GIS functions and aggregates on Oracle. Thanks to Norbert Szetei for the report.
2020-02-24 21:46:28 +08:00
CVE-2020-9402: Potential SQL injection via ``tolerance`` parameter in GIS functions and aggregates on Oracle
============================================================================================================
GIS functions and aggregates on Oracle were subject to SQL injection,
using a suitably crafted ``tolerance``.