GitHub Advisoryadvisory · PyPI
GHSA-2hrw-hx67-34x6 Resource exhaustion in Django
HIGH
Official page ↗
- Aliases
- CVE-2023-24580
- Ecosystem
- PyPI
- Packages
- Django
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
- Reviewed
- 2023-02-15
Affected packages
• PyPI Django: >= 3.2a1, < 3.2.18 → fixed in 3.2.18
• PyPI Django: >= 4.1a1, < 4.1.7 → fixed in 4.1.7
• PyPI Django: >= 4.0a1, < 4.0.10 → fixed in 4.0.10
Description
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
Related
Alias · CVE (1)
- CVE-2023-24580 An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-24580 advisory
- https://github.com/django/django/commit/628b33a854a9c68ec8a0c51f382f304a0044ec92 web
- https://github.com/django/django/commit/83f1ea83e4553e211c1c5a0dfc197b66d4e50432 web
- https://github.com/django/django/commit/a665ed5179f5bbd3db95ce67286d0192eff041d8 web
- https://www.djangoproject.com/weblog/2023/feb/14/security-releases web
- https://security.netapp.com/advisory/ntap-20230316-0006 web
- https://lists.fedoraproject.org/archives/list/[email protected]/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP web
- https://lists.fedoraproject.org/archives/list/[email protected]/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77 web
- https://lists.fedoraproject.org/archives/list/[email protected]/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI web
- https://lists.fedoraproject.org/archives/list/[email protected]/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK web
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B web
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP web
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77 web
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI web
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK web
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B web
- https://lists.debian.org/debian-lts-announce/2023/02/msg00023.html web
- https://groups.google.com/forum/#%21forum/django-announce web
- https://groups.google.com/forum/#!forum/django-announce web
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-13.yaml web
- https://github.com/django/django package
- https://docs.djangoproject.com/en/4.1/releases/security web
- http://www.openwall.com/lists/oss-security/2023/02/14/1 web