Vulnerability advisory
CVE-2023-24580
Also known as BIT-django-2023-24580GHSA-2hrw-hx67-34x6PYSEC-2023-13
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/django/django ↗ | |
| 3591e1c1acbd7c13174275367c3fdf012cb0413b to before 722e9f8a38f5b34f2423059a75f8a59bb8eb931a | 722e9f8a38f5b34f2423059a75f8a59bb8eb931a |
| ef62a3a68c9d558486145a42c0d71ea9a76add9e to before 4d51383f09870e3dade9967a60c956fb81b874a7 | 4d51383f09870e3dade9967a60c956fb81b874a7 |
| 9fee86e44dd83dc968ec443adcde191b3eba1286 to before c57ff9ba5e251cd4c2761105a6046662c08f951e | c57ff9ba5e251cd4c2761105a6046662c08f951e |
Description
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
References
- Webwww.openwall.com/lists/oss-security/2023/02/14/1 ↗
- Webdocs.djangoproject.com/en/4.1/releases/security/ ↗
- Webgroups.google.com/forum/#%21forum/django-announce ↗
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24580.json ↗
- Advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B/ ↗
- Advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/ ↗
- Advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/ ↗
- Advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77/ ↗
- Advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP/ ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-24580 ↗
- Advisorysecurity.netapp.com/advisory/ntap-20230316-0006/ ↗
- ARTICLElists.debian.org/debian-lts-announce/2023/02/msg00023.html ↗
- ARTICLEwww.djangoproject.com/weblog/2023/feb/14/security-releases/ ↗