Recently, Django released a security bulletin, the bulletin announced a potential SQL injection vulnerability (CVE-2020-7471), has been the vulnerability be exploited by StringAgg (separator).
An attacker may be passed to the constructor separator django.contrib.postgres.aggregates.StringAgg aggregation function, and to bypass the escape inject malicious SQL statements.
Affected versions
- Django master branch
- Django 3.0
- Django 2.2
- Django 1.11
solution
Django officially released a new version of the original fix the above vulnerabilities. Affected users will be updated to the master branch Django and 3.0,2.2 and 1.11 version branch as soon as possible
If pip installed Django, you can be operated using the following command: