Vulnerability Description
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Djangoproject | Django | >= 3.2, < 3.2.18 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2023/02/14/1Mailing ListRelease NotesThird Party Advisory
- https://docs.djangoproject.com/en/4.1/releases/security/PatchVendor Advisory
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.debian.org/debian-lts-announce/2023/02/msg00023.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.netapp.com/advisory/ntap-20230316-0006/
- https://www.djangoproject.com/weblog/2023/feb/14/security-releases/PatchRelease NotesVendor Advisory
- http://www.openwall.com/lists/oss-security/2023/02/14/1Mailing ListRelease NotesThird Party Advisory
- https://docs.djangoproject.com/en/4.1/releases/security/PatchVendor Advisory
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.debian.org/debian-lts-announce/2023/02/msg00023.htmlMailing ListThird Party Advisory
FAQ
What is CVE-2023-24580?
CVE-2023-24580 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart f...
How severe is CVE-2023-24580?
CVE-2023-24580 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-24580?
Check the references section above for vendor advisories and patch information. Affected products include: Djangoproject Django, Debian Debian Linux.