CVE-2022-23833: High severity djangoproject Django vulnerability
A flaw was found in Django. The issue occurs when passing certain inputs to multipart forms, resulting in an infinite loop when parsing files.
Other sources
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/python-django20to a version that resolves this vulnerability.Fixed in 0:2.0.13-18.el8 - Upgrade
Upgrade
redhat/python-djangoto a version that resolves this vulnerability.Fixed in 0:3.2.13-1.el8 - Upgrade
Upgrade
redhat/djangoto a version that resolves this vulnerability.Fixed in 4.0.2 - Upgrade
Upgrade
redhat/djangoto a version that resolves this vulnerability.Fixed in 3.2.12 - Upgrade
Upgrade
redhat/djangoto a version that resolves this vulnerability.Fixed in 2.2.27 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.0.2 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 3.2.12 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 2.2.27 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 3.2.12-r0 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 2:3.2.12-1 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.25-0+deb12u3Fixed in 3:3.2.25-0+deb12u6Fixed in 3:4.2.28-0+deb13u2Fixed in 3:4.2.28-0+deb13u1Fixed in 3:5.2.17-2Fixed in 3:5.2.19-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-23833?
CVE-2022-23833 is a vulnerability discovered in Django.
What is the severity of CVE-2022-23833?
CVE-2022-23833 has a severity level of high.
How does CVE-2022-23833 affect Django?
CVE-2022-23833 affects Django versions 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2.
What is the solution for CVE-2022-23833?
To fix CVE-2022-23833, you need to update Django to version 2.2.27, 3.2.12, or 4.0.2.
Where can I find more information about CVE-2022-23833?
You can find more information about CVE-2022-23833 in the references provided: [reference 1](https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1858150), [reference 2](https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1858150&action=edit), [reference 3](https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1858151).