PyPI/wagtail CVE-2023-28837: unknown, EPSS 1.07%
Wagtail is an open source content management system built on Django. Prior to versions 4.1.4 and 4.2.2, a memory exhaustion bug exists in Wagtail's handling of uploaded images and documents. For both
Action: Upgrade wagtail to 4.1.4 or later.
pip install wagtail==4.2.2pip install wagtail==4.1.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.1.4 | - |
| 4.2 | 4.2.2 | - |
Fixed versions
| 4.2.2 | 4.1.4 |
Sources
- osv: PYSEC-2023-56
- https://github.com/wagtail/wagtail/commit/cfa11bbe00dbe7ce8cd4c0bbfe2a898a690df2bf
- https://github.com/wagtail/wagtail/releases/tag/v4.2.2
- https://github.com/wagtail/wagtail/commit/3c0c64642b9e5b8d28b111263c7f4bddad6c3880
- https://github.com/wagtail/wagtail/security/advisories/GHSA-33pv-vcgh-jfg9
- https://docs.wagtail.org/en/stable/reference/settings.html#wagtailimages-max-upload-size
- https://github.com/wagtail/wagtail/commit/c9d2fcd650a88d76ae122646142245e5927a9165
- https://github.com/wagtail/wagtail/commit/d4022310cbe497993459c3136311467c7ac6329a
- https://github.com/wagtail/wagtail/releases/tag/v4.1.4
CVE-2023-28837 · published · modified · JSON