CVE-2022-23833

2 advisories.

PyPI/django CVE-2022-23833: high 7.5

Infinite Loop in Django

Action: Upgrade django to 2.2.27 or later.

pip install django==2.2.27

pip install django==3.2.12

pip install django==4.0.2

Affected

introduced	fixed	last affected
2.2	2.2.27	-
3.2	3.2.12	-
4.0	4.0.2	-

Fixed versions

2.2.27

3.2.12

4.0.2

Sources

osv: GHSA-6cw3-g6wv-c2xv
https://nvd.nist.gov/vuln/detail/CVE-2022-23833
https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6a
https://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468
https://github.com/django/django/commit/f9c7d48fdd6f198a6494a9202f90242f176e4fc9
https://docs.djangoproject.com/en/4.0/releases/security
https://github.com/advisories/GHSA-6cw3-g6wv-c2xv
https://github.com/django/django
https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-20.yaml
https://groups.google.com/forum/#!forum/django-announce
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
https://security.netapp.com/advisory/ntap-20220221-0003
https://www.debian.org/security/2022/dsa-5254
https://www.djangoproject.com/weblog/2022/feb/01/security-releases

CVE-2022-23833 · published 2022-02-04T00:00:26Z · modified 2024-09-20T15:47:27.155401Z · JSON

PyPI/django CVE-2022-23833: unknown

An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing