high7.5
CVE-2022-23833
Infinite Loop in Django
Impact
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | Django | >= 2.2, < 2.2.27 | 2.2.27 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Djangoproject | Django | from 2.2 before 2.2.27 from 3.2 before 3.2.12 from 4.0 before 4.0.2 |
| Fedoraproject | Fedora | Versions 34, 35 |
| Debian | Debian Linux | Version 11.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://docs.djangoproject.com/en/4.0/releases/security/
- https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6a
- https://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468
- https://github.com/django/django/commit/f9c7d48fdd6f198a6494a9202f90242f176e4fc9
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/
- https://security.netapp.com/advisory/ntap-20220221-0003/
- https://www.debian.org/security/2022/dsa-5254
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases/
- https://github.com/advisories/GHSA-6cw3-g6wv-c2xv
- https://nvd.nist.gov/vuln/detail/CVE-2022-23833
- https://groups.google.com/forum/#!forum/django-announce
- https://docs.djangoproject.com/en/4.0/releases/security
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
- https://security.netapp.com/advisory/ntap-20220221-0003
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-20.yaml