GitHub Advisoryadvisory · PyPI

GHSA-6cw3-g6wv-c2xv Infinite Loop in Django

HIGH Published 2022-02-04 Modified 2024-09-20 Official page ↗

Aliases: CVE-2022-23833
Ecosystem: PyPI
Packages: Django
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-835
Reviewed: 2022-02-04

Affected packages

• PyPI Django: >= 2.2, < 2.2.27 → fixed in 2.2.27 • PyPI Django: >= 3.2, < 3.2.12 → fixed in 3.2.12 • PyPI Django: >= 4.0, < 4.0.2 → fixed in 4.0.2

Description

An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.

Alias · CVE (1)

CVE-2022-23833 An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. vulnerability

Weakness · CWE (1)

CWE-835 Loop with Unreachable Exit Condition weakness

References