GHSA-6cw3-g6wv-c2xvHighCVSS 7.5
Infinite Loop in Django
🔗 CVE IDs covered (1)
📋 Description
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
🎯 Affected products3
- pip/Django:>= 2.2, < 2.2.27
- pip/Django:>= 3.2, < 3.2.12
- pip/Django:>= 4.0, < 4.0.2
🔗 References (12)
- https://nvd.nist.gov/vuln/detail/CVE-2022-23833
- https://groups.google.com/forum/#!forum/django-announce
- https://www.debian.org/security/2022/dsa-5254
- https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6a
- https://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468
- https://docs.djangoproject.com/en/4.0/releases/security
- https://lists.fedoraproject.org/archives/list/[email protected]/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV
- https://security.netapp.com/advisory/ntap-20220221-0003
- https://www.djangoproject.com/weblog/2022/feb/01/security-releases
- https://github.com/django/django/commit/f9c7d48fdd6f198a6494a9202f90242f176e4fc9
- https://github.com/advisories/GHSA-6cw3-g6wv-c2xv
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-20.yaml