PyPI/django CVE-2023-31047: critical 9.8, EPSS 1.39%
Django bypasses validation when using one form field to upload multiple files
Action: Upgrade django to 3.2.19 or later.
pip install django==3.2.19pip install django==4.1.9pip install django==4.2.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.2a1 | 3.2.19 | - |
| 4.0a1 | 4.1.9 | - |
| 4.2a1 | 4.2.1 | - |
Fixed versions
| 3.2.19 | 4.1.9 | 4.2.1 |
Sources
- osv: GHSA-r3xc-prgr-mg9p
- https://nvd.nist.gov/vuln/detail/CVE-2023-31047
- https://github.com/django/django/commit/21b1b1fc03e5f9e9f8c977ee6e35618dd3b353dd
- https://github.com/django/django/commit/e7c3a2ccc3a562328600be05068ed9149e12ce64
- https://github.com/django/django/commit/eed53d0011622e70b936e203005f0e6f4ac48965
- https://docs.djangoproject.com/en/4.2/releases/security
- https://github.com/django/django
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-61.yaml
- https://groups.google.com/forum/#!forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNEHD6N435OE2XUFGDAAVAXSYWLCUBFD
- https://security.netapp.com/advisory/ntap-20230609-0008
- https://www.djangoproject.com/weblog/2023/may/03/security-releases
CVE-2023-31047 · published · modified · JSON