CVEvulnerability
CVE-2022-23833
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-02-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
- Weaknesses
- CWE-835
Description
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
Affected configurations
• djangoproject django (>= 2.2 < 2.2.27)
• djangoproject django (>= 3.2 < 3.2.12)
• djangoproject django (>= 4.0 < 4.0.2)
• fedoraproject fedora 34
• fedoraproject fedora 35
• debian debian linux 11.0
Related
Weakness · CWE (1)
- CWE-835 Loop with Unreachable Exit Condition weakness
References
- https://docs.djangoproject.com/en/4.0/releases/security/ Patch, Third Party Advisory
- https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6a github.com
- https://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468 github.com
- https://github.com/django/django/commit/f9c7d48fdd6f198a6494a9202f90242f176e4fc9 github.com
- https://groups.google.com/forum/#%21forum/django-announce groups.google.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20220221-0003/ Third Party Advisory
- https://www.debian.org/security/2022/dsa-5254 Third Party Advisory
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases/ Patch, Third Party Advisory
- https://docs.djangoproject.com/en/4.0/releases/security/ Patch, Third Party Advisory
- https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6a github.com
- https://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468 github.com
- https://github.com/django/django/commit/f9c7d48fdd6f198a6494a9202f90242f176e4fc9 github.com
- https://groups.google.com/forum/#%21forum/django-announce groups.google.com
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/ lists.fedoraproject.org
- https://security.netapp.com/advisory/ntap-20220221-0003/ Third Party Advisory
- https://www.debian.org/security/2022/dsa-5254 Third Party Advisory
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases/ Patch, Third Party Advisory