Vulnerability advisory

PYSEC-2022-20

Published Feb 3, 2022Updated Dec 6, 2023OSV record ↗

Also known as BIT-django-2022-23833CVE-2022-23833GHSA-6cw3-g6wv-c2xv

Severity

Severity not reported.

Affected versions

django PyPI

Affected	Fixed in
`2.2` to before 2.2.27	`2.2.27`Advisories →
`3.2` to before 3.2.12	`3.2.12`Advisories →
`4.0` to before 4.0.2	`4.0.2`Advisories →
Also listed as affected (41) `2.2` `2.2.1` `2.2.10` `2.2.11` `2.2.12` `2.2.13` `2.2.14` `2.2.15` `2.2.16` `2.2.17` `2.2.18` `2.2.19` `2.2.2` `2.2.20` `2.2.21` `2.2.22` `2.2.23` `2.2.24` `2.2.25` `2.2.26` `2.2.3` `2.2.4` `2.2.5` `2.2.6` `2.2.7` `2.2.8` `2.2.9` `3.2` `3.2.1` `3.2.10` `3.2.11` `3.2.2` `3.2.3` `3.2.4` `3.2.5` `3.2.6` `3.2.7` `3.2.8` `3.2.9` `4.0` `4.0.1`

Description

An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.

References

Webdocs.djangoproject.com/en/4.0/releases/security/ ↗
ARTICLEwww.djangoproject.com/weblog/2022/feb/01/security-releases/ ↗
Webgroups.google.com/forum/#!forum/django-announce ↗
Advisorygithub.com/advisories/GHSA-6cw3-g6wv-c2xv ↗