[Debian] High CVE: CVE-2023-36053/CVE-2023-23969/CVE-2023-24580/CVE-2023-31047 python-django: multiple CVEs
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| StarlingX |
Fix Released
|
High
|
Wentao Zhang | ||
Bug Description
CVE-2023-36053: https:/
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
CVE-2023-23969: https:/
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
CVE-2023-24580: https:/
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
CVE-2023-31047: https:/
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
Base Score: High
Reference:
['python3-
https:/
https:/
CVE References
| tags: | added: stx.9.0 stx.security |
| Changed in starlingx: | |
| assignee: | nobody → Wentao Zhang (wzhang4) |
| OpenStack Infra (hudson-openstack) wrote Fix proposed to tools (master) | #1 |
| Changed in starlingx: | |
| status: | Triaged → In Progress |
| OpenStack Infra (hudson-openstack) wrote Fix merged to tools (master) | #2 |
| Changed in starlingx: | |
| status: | In Progress → Fix Released |
| Ghada Khalil (gkhalil) wrote | #3 |
| Changed in starlingx: | |
| status: | Fix Released → In Progress |
| OpenStack Infra (hudson-openstack) wrote Fix proposed to tools (master) | #4 |
| OpenStack Infra (hudson-openstack) wrote Fix merged to tools (master) | #5 |
| Changed in starlingx: | |
| status: | In Progress → Fix Released |
Fix proposed to branch: master
Review: https:/