GHSA-x7gm-rfgv-w973

Suggest an improvement
Source
https://github.com/advisories/GHSA-x7gm-rfgv-w973
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-x7gm-rfgv-w973/GHSA-x7gm-rfgv-w973.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-x7gm-rfgv-w973
Aliases
Related
Published
2020-09-28T19:05:29Z
Modified
2024-09-16T22:22:30.086591Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Potential DoS with NumberFilter conversion to integer values.
Details

Impact

Automatically generated NumberFilter instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents.

Patches

Version 2.4.0+ applies a MaxValueValidator with a a default limit_value of 1e50 to the form field used by NumberFilter instances.

In addition, NumberFilter implements the new get_max_validator() which should return a configured validator instance to customise the limit, or else None to disable the additional validation.

Workarounds

Users may manually apply an equivalent validator if they are not able to upgrade.

For more information

If you have any questions or comments about this advisory: * Open an issue in the django-filter repo

Thanks to Marcin Waraksa for the report.

Database specific 
{
    "nvd_published_at": "2021-04-29T21:15:00Z",
    "cwe_ids": [
        "CWE-681"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-09-28T19:04:39Z"
}
References

Affected packages

PyPI / django-filter

Package

Name
django-filter
View open source insights on deps.dev
Purl
pkg:pypi/django-filter

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.0

Affected versions

0.*

0.1.0
0.2.0
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.6a1
0.6
0.7
0.8
0.9.0
0.9.1
0.9.2
0.10.0
0.11.0
0.12.0
0.13.0
0.14.0
0.15.0
0.15.1
0.15.2
0.15.3

1.*

1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.1.0

2.*

2.0.0.dev1
2.0.0
2.1.0
2.2.0
2.3.0