BIT-django-2023-24580

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/django/BIT-django-2023-24580.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-django-2023-24580
Aliases
Published
2024-03-06T10:52:03.082Z
Modified
2024-03-06T11:25:28.861Z
Summary
[none]
Details

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

Database specific
{
    "cpes": [
        "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
}
References

Affected packages

Bitnami / django

Package

Name
django
Purl
pkg:bitnami/django

Severity

  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
3.2.0
Fixed
3.2.18
Introduced
4.0.0
Fixed
4.0.10
Introduced
4.1.0
Fixed
4.1.7