CVE-2022-23833
published 2022-02-03CVE-2022-23833: An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms…
PriorityP357high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
49.25%
98.7th percentile
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | python-django | < python-django 2:3.2.12-1 (bookworm) | python-django 2:3.2.12-1 (bookworm) |
| djangoproject | django | >= 2.2 < 2.2.27 | 2.2.27 |
| djangoproject | django | >= 2.2 < 2.2.27 | 2.2.27 |
| djangoproject | django | >= 3.2 < 3.2.12 | 3.2.12 |
| djangoproject | django | >= 3.2 < 3.2.12 | 3.2.12 |
| djangoproject | django | >= 4.0 < 4.0.2 | 4.0.2 |
| djangoproject | django | >= 4.0 < 4.0.2 | 4.0.2 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-django vulnerabilities
osv·2022-02-07·CVSS 6.1
CVE-2022-22818 [MEDIUM] python-django vulnerabilities
python-django vulnerabilities
USN-5269-1 fixed several vulnerabilities in Django. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
Keryn Knight discovered that Django incorrectly handled certain template
tags. A remote attacker could possibly use this issue to perform a
cross-site scripting attack. (CVE-2022-22818)
Alan Ryan discovered that Django incorrectly handled file uploads. A remote
attacker could possibly use this issue to cause Django to hang, resulting
in a denial of service. (CVE-2022-23833)
GHSA
Infinite Loop in Django
ghsa·2022-02-04
CVE-2022-23833 [HIGH] CWE-835 Infinite Loop in Django
Infinite Loop in Django
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
OSV
Infinite Loop in Django
osv·2022-02-04
CVE-2022-23833 [HIGH] Infinite Loop in Django
Infinite Loop in Django
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
OSV
CVE-2022-23833: An issue was discovered in MultiPartParser in Django 2
osv·2022-02-03·CVSS 7.5
CVE-2022-23833 [HIGH] CVE-2022-23833: An issue was discovered in MultiPartParser in Django 2
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
OSV
python-django vulnerabilities
osv·2022-02-03·CVSS 6.1
CVE-2022-22818 [MEDIUM] python-django vulnerabilities
python-django vulnerabilities
Keryn Knight discovered that Django incorrectly handled certain template
tags. A remote attacker could possibly use this issue to perform a
cross-site scripting attack. (CVE-2022-22818)
Alan Ryan discovered that Django incorrectly handled file uploads. A remote
attacker could possibly use this issue to cause Django to hang, resulting
in a denial of service. (CVE-2022-23833)
Ubuntu
Django vulnerabilities
vendor_ubuntu·2022-02-07·CVSS 6.1
CVE-2022-22818 [MEDIUM] Django vulnerabilities
Title: Django vulnerabilities
Summary: Several security issues were fixed in Django.
USN-5269-1 fixed several vulnerabilities in Django. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
Keryn Knight discovered that Django incorrectly handled certain template
tags. A remote attacker could possibly use this issue to perform a
cross-site scripting attack. (CVE-2022-22818)
Alan Ryan discovered that Django incorrectly handled file uploads. A remote
attacker could possibly use this issue to cause Django to hang, resulting
in a denial of service. (CVE-2022-23833)
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Django vulnerabilities
vendor_ubuntu·2022-02-03·CVSS 6.1
CVE-2022-22818 [MEDIUM] Django vulnerabilities
Title: Django vulnerabilities
Summary: Several security issues were fixed in Django.
Keryn Knight discovered that Django incorrectly handled certain template
tags. A remote attacker could possibly use this issue to perform a
cross-site scripting attack. (CVE-2022-22818)
Alan Ryan discovered that Django incorrectly handled file uploads. A remote
attacker could possibly use this issue to cause Django to hang, resulting
in a denial of service. (CVE-2022-23833)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
django: Denial-of-service possibility in file uploads
vendor_redhat·2022-02-01·CVSS 7.5
CVE-2022-23833 [HIGH] CWE-835 django: Denial-of-service possibility in file uploads
django: Denial-of-service possibility in file uploads
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
A flaw was found in Django. The issue occurs when passing certain inputs to multipart forms, resulting in an infinite loop when parsing files.
Package: python-django (Red Hat Ansible Automation Platform 1.2) - Affected
Package: python-django (Red Hat Ansible Automation Platform 2) - Affected
Package: django (Red Hat Ansible Tower 3) - Affected
Package: calamari-server (Red Hat Ceph Storage 2) - Out of support scope
Package: python-django (Red Hat Ceph Storage 2) - Out of support scope
Package: python-django (Red Hat Ceph Sto
Debian
CVE-2022-23833: python-django - An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 befo...
vendor_debian·2022·CVSS 7.5
CVE-2022-23833 [HIGH] CVE-2022-23833: python-django - An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 befo...
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
Scope: local
bookworm: resolved (fixed in 2:3.2.12-1)
bullseye: resolved (fixed in 2:2.2.28-1~deb11u1)
forky: resolved (fixed in 2:3.2.12-1)
sid: resolved (fixed in 2:3.2.12-1)
trixie: resolved (fixed in 2:3.2.12-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://docs.djangoproject.com/en/4.0/releases/security/https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6ahttps://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468https://github.com/django/django/commit/f9c7d48fdd6f198a6494a9202f90242f176e4fc9https://groups.google.com/forum/#%21forum/django-announcehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/https://security.netapp.com/advisory/ntap-20220221-0003/https://www.debian.org/security/2022/dsa-5254https://www.djangoproject.com/weblog/2022/feb/01/security-releases/https://docs.djangoproject.com/en/4.0/releases/security/https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6ahttps://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468https://github.com/django/django/commit/f9c7d48fdd6f198a6494a9202f90242f176e4fc9https://groups.google.com/forum/#%21forum/django-announcehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/https://security.netapp.com/advisory/ntap-20220221-0003/https://www.debian.org/security/2022/dsa-5254https://www.djangoproject.com/weblog/2022/feb/01/security-releases/
2022-02-03
Published