BIT-django-2022-23833
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/django/BIT-django-2022-23833.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-django-2022-23833
- Aliases
- Published
- 2024-03-06T10:53:17.707Z
- Modified
- 2024-03-06T11:25:28.861Z
- Summary
- [none]
- Details
-
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
- References
-
- https://docs.djangoproject.com/en/4.0/releases/security/
- https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6a
- https://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468
- https://github.com/django/django/commit/f9c7d48fdd6f198a6494a9202f90242f176e4fc9
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
- https://security.netapp.com/advisory/ntap-20220221-0003/
- https://www.debian.org/security/2022/dsa-5254
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases/
Affected packages
Bitnami / django
Package
- Name
- django
- Purl
- pkg:bitnami/django
Severity
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator