CVE-2020-7471
CriticalSQL injection in Django
Published Feb 11, 2020 · Updated Sep 8, 2026 · Also known as ALPINE-CVE-2020-7471, BIT-django-2020-7471, DEBIAN-CVE-2020-7471, DSA-4629-1, GHSA-hmr4-m2h5-33qx, PYSEC-2020-35, UBUNTU-CVE-2020-7471, USN-4264-1
Key Facts
Patch immediately- CVE-2020-7471 is a critical-severity vulnerability (CVSS 9.3 v4) affecting Django (Djangoproject), python-Django (arch), py3-django (alpine) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 66% probability of exploitation in the next 30 days.
- Fixed versions are available, including ansible 2.9.14-3.15.1, ansible1 1.9.6-9.7.2, ardana-ansible 8.0+git.1596735237.54109b1-3.77.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v4
9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS (30-day exploit likelihood)
66%
Higher than 99.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2020-7471 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.
Affected Products
754 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| DjangoDjangoproject | >= 1.11.0, >= 3.0 | 1.11.28 |
| python-Djangoarch | See advisory | 3.0.3-1 |
| py3-djangoalpine | See advisory | 1.11.28-r0 |
| py-djangoalpine | See advisory | 1.11.28-r0 |
| ansible1suse | See advisory | 1.9.6-9.7.2 |
Patched Releases
ansible
2.9.14-3.15.1
ansible1
1.9.6-9.7.2
ardana-ansible
8.0+git.1596735237.54109b1-3.77.1, 9.0+git.1591138508.e269bdb-3.22.2
ardana-cinder
8.0+git.1596129856.263f430-3.43.1
ardana-cobbler
9.0+git.1588181228.bae3b1f-3.13.2
ardana-glance
8.0+git.1593631779.76fa9b7-3.24.1, 9.0+git.1593631708.9354a78-3.13.2
ardana-input-model
9.0+git.1589740948.c24fc0b-3.19.2
ardana-logging
9.0+git.1591193994.d93b668-3.13.2
ardana-manila
9.0+git.1594158642.b5905e4-3.12.2
ardana-monasca
9.0+git.1589385256.7fbfaaf-3.19.2
ardana-mq
8.0+git.1593618123.678c32b-3.26.1, 9.0+git.1593618110.cbd1a37-3.16.2
ardana-neutron
9.0+git.1590756257.e09d54f-3.22.2
ardana-nova
8.0+git.1601298847.dd01585-3.42.1
ardana-octavia
9.0+git.1590079609.a2ae6ab-3.19.2
ardana-osconfig
8.0+git.1595885113.93abcbc-3.49.1
ardana-tempest
9.0+git.1593033709.9495bb2-3.16.2
crowbar-core
5.0+git.1600432272.b3ad722f0-3.44.1, 6.0+git.1594619891.b75a61d0d-3.25.5
crowbar-core-branding-upstream
5.0+git.1600432272.b3ad722f0-3.44.1, 6.0+git.1594619891.b75a61d0d-3.25.5
crowbar-openstack
5.0+git.1599037158.5c4d07480-4.43.1, 6.0+git.1591795073.49cb6400e-3.25.3
Django
1.11.28, 2.2.10, 3.0.3, eb31d845323618d688ad429479c6dda973056136
documentation-hpe-helion-openstack-installation
8.20201007-1.29.1
documentation-hpe-helion-openstack-operations
8.20201007-1.29.1
documentation-hpe-helion-openstack-opsconsole
8.20201007-1.29.1
documentation-hpe-helion-openstack-planning
8.20201007-1.29.1
documentation-hpe-helion-openstack-security
8.20201007-1.29.1
Timeline
Publicly disclosed
Feb 11, 2020
Last updated
Sep 8, 2026
Weakness Type
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
References
- advisoryhttps://bugzilla.suse.com/1008037
- advisoryhttps://bugzilla.suse.com/1008038
- advisoryhttps://bugzilla.suse.com/1010940
- advisoryhttps://bugzilla.suse.com/1019021
- advisoryhttps://bugzilla.suse.com/1019111
FAQ
Common Questions.
Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter).
Affected: Django (Djangoproject) versions >= 1.11.0, >= 3.0; python-Django (arch); py3-django (alpine), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including ansible 2.9.14-3.15.1, ansible1 1.9.6-9.7.2, ardana-ansible 8.0+git.1596735237.54109b1-3.77.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2020-7471 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo