Vulnerability advisory

GHSA-6cw3-g6wv-c2xv

Infinite Loop in Django

Published Feb 4, 2022Updated Sep 20, 2024OSV record ↗

Also known as BIT-django-2022-23833CVE-2022-23833PYSEC-2022-20

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected versions

django PyPI

All django advisories →

Affected	Fixed in
`2.2` to before 2.2.27	`2.2.27`Advisories →
Also listed as affected (27) `2.2` `2.2.1` `2.2.10` `2.2.11` `2.2.12` `2.2.13` `2.2.14` `2.2.15` `2.2.16` `2.2.17` `2.2.18` `2.2.19` `2.2.2` `2.2.20` `2.2.21` `2.2.22` `2.2.23` `2.2.24` `2.2.25` `2.2.26` `2.2.3` `2.2.4` `2.2.5` `2.2.6` `2.2.7` `2.2.8` `2.2.9`
`3.2` to before 3.2.12	`3.2.12`Advisories →
Also listed as affected (12) `3.2` `3.2.1` `3.2.10` `3.2.11` `3.2.2` `3.2.3` `3.2.4` `3.2.5` `3.2.6` `3.2.7` `3.2.8` `3.2.9`
`4.0` to before 4.0.2	`4.0.2`Advisories →
Also listed as affected (2) `4.0` `4.0.1`

Description

An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.

GHSA-6cw3-g6wv-c2xv

Affected versions

django PyPI

Description

References