Vulnerability · Published Feb 15, 2023 · Assigned by mitre
CVE-2023-24580
High 7.5
In plain English
A high-severity uncontrolled resource consumption in the py3-django package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 62.6% (higher than 99.2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | py3-django | 3.2.18-r0 | ALPINE-CVE-2023-24580 |
| Alpine:v3.21 | py3-django | 3.2.18-r0 | ALPINE-CVE-2023-24580 |
| Alpine:v3.22 | py3-django | 3.2.18-r0 | ALPINE-CVE-2023-24580 |
| Alpine:v3.23 | py3-django | 3.2.18-r0 | ALPINE-CVE-2023-24580 |
| Alpine:v3.24 | py3-django | 3.2.18-r0 | ALPINE-CVE-2023-24580 |
| Debian:12 | python-django | 3:3.2.18-1 | DEBIAN-CVE-2023-24580 |
| Debian:13 | python-django | 3:3.2.18-1 | DEBIAN-CVE-2023-24580 |
| Debian:14 | python-django | 3:3.2.18-1 | DEBIAN-CVE-2023-24580 |
| PyPI | django | 4.0.10 | GHSA-2hrw-hx67-34x6 |
| PyPI | django | 3.2.18, 4.0.10, 4.1.7 | PYSEC-2023-13 |
| PyPI | django | 4.1.7 | GHSA-2hrw-hx67-34x6 |
| PyPI | django | 3.2.18 | GHSA-2hrw-hx67-34x6 |
| Ubuntu:22.04:LTS | python-django | 2:3.2.12-2ubuntu1.5 | UBUNTU-CVE-2023-24580 |
| Ubuntu:22.04:LTS | python-django | 2:3.2.12-2ubuntu1.5 | USN-5868-1 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://groups.google.com/forum/#%21forum/django-announce
- https://docs.djangoproject.com/en/4.1/releases/security/
- http://www.openwall.com/lists/oss-security/2023/02/14/1
- https://www.djangoproject.com/weblog/2023/feb/14/security-releases/
- [debian-lts-announce] 20230220 [SECURITY] [DLA 3329-1] python-django security update mailing-list
- FEDORA-2023-3d775d93be vendor-advisory
- FEDORA-2023-bde7913e5a vendor-advisory
- FEDORA-2023-a74513bda8 vendor-advisory
- https://security.netapp.com/advisory/ntap-20230316-0006/
- FEDORA-2023-8fed428c5e vendor-advisory
- FEDORA-2023-a53ab7c969 vendor-advisory