← Retour aux CVEs

CVE-2023-24580

HIGH

7.5

Description

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

Details CVE

Score CVSS v3.17.5

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie2/15/2023

Derniere modification3/18/2025

Sourcenvd

Observations honeypot0

Produits affectes

debian:debian_linuxdjangoproject:django

Faiblesses (CWE)

CWE-400CWE-400

References

http://www.openwall.com/lists/oss-security/2023/02/14/1(cve@mitre.org)

https://docs.djangoproject.com/en/4.1/releases/security/(cve@mitre.org)

https://groups.google.com/forum/#%21forum/django-announce(cve@mitre.org)

https://lists.debian.org/debian-lts-announce/2023/02/msg00023.html(cve@mitre.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B/(cve@mitre.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/(cve@mitre.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/(cve@mitre.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77/(cve@mitre.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP/(cve@mitre.org)

https://security.netapp.com/advisory/ntap-20230316-0006/(cve@mitre.org)

https://www.djangoproject.com/weblog/2023/feb/14/security-releases/(cve@mitre.org)

http://www.openwall.com/lists/oss-security/2023/02/14/1(af854a3a-2127-422b-91ae-364da2661108)

https://docs.djangoproject.com/en/4.1/releases/security/(af854a3a-2127-422b-91ae-364da2661108)

https://groups.google.com/forum/#%21forum/django-announce(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2023/02/msg00023.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP/(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20230316-0006/(af854a3a-2127-422b-91ae-364da2661108)

https://www.djangoproject.com/weblog/2023/feb/14/security-releases/(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.