CVE-2023-24580

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

A high-level Python Web framework that encourages rapid development and clean, pragmatic design.

Security Fix(es):

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.(CVE-2023-24580)

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

TuxCare rebuilt django to address 2 CVEs. Fixed in 4.0.post1+tuxcare.

Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack. (CVE-2023-24580) Bypass of validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise. (CVE-2023-31047)

python-Django was updated to fix a security issues:

• CVE-2023-24580: prevent DOS in file uploads (bsc#1208082)

python-Django was update to fix:

• CVE-2023-24580: Prevent DOS in file uploads. (bsc#1208082)

This update for python-Django fixes the following issues:

• CVE-2023-24580: Prevent DOS in file uploads. (boo#1208082)

update to 1.11.15

• CVE-2018-14574: Fixed Open redirect possibility in CommonMiddleware (boo#1102680)
• Fixed WKBWriter.write() and write_hex() for empty polygons on GEOS 3.6.1+
• Fixed a regression in Django 1.10 that could result in large memory usage when making edits using ModelAdmin.list_editable
• Fixed a regression in Django 1.11.12 where QuerySet.values() or values_list() after combining an annotated and unannotated queryset with union(), difference(), or intersection() crashed due to mismatching columns
• Fixed crashes in django.contrib.admindocs when a view is a callable object, such as django.contrib.syndication.views.Feed
• Fixed a regression in Django 1.11.8 where altering a field with a unique constraint may drop and rebuild more foreign keys than necessary
• Fixed a regression in Django 1.11.8 where combining two annotated values_list() querysets with union(), difference(), or intersection() crashed due to mismatching columns
• Fixed a regression in Django 1.11 where an empty choice could be initially selected for the SelectMultiple and CheckboxSelectMultiple widgets

• Update to 1.11.11

  • Fixes CVE-2018-7536, CVE-2018-7537

• Update to 1.11.10 LTS

  • Fixes CVE-2018-6188 boo#1077714, CVE-2017-7234, CVE-2017-7233, CVE-2017-12794

• Change Requires: python-Pillow to python-imaging for compatibility with SLE-12 which provides PIL instead of Pillow.

• Update to 1.9.9

  Bugfixes

  • Fixed invalid HTML in template postmortem on the debug page (#26938).
  • Fixed some GIS database function crashes on MySQL 5.7 (#26657).

• Update to 1.9.8 Fix XSS in admin’s add/change related popup (boo#988420) Unsafe usage of JavaScript’s Element.innerHTML could result in XSS in the admin’s add/change related popup. Element.textContent is now used to prevent execution of the data. The debug view also used innerHTML. Although a security issue wasn’t identified there, out of an abundance of caution it’s also updated to use textContent. Bugfixes

  • Fixed missing varchar/text_pattern_ops index on CharField and TextField respectively when using AddField on PostgreSQL (#26889).
  • Fixed makemessages crash on Python 2 with non-ASCII file names (#26897).

• Update to 1.9.7 Bugfixes

  • Removed the need for the request context processor on the admin login page to fix a regression in 1.9 (#26558).
  • Fixed translation of password validators’ help_text in forms (#26544).
  • Fixed a regression causing the cached template loader to crash when using lazy template names (#26603).
  • Fixed on_commit callbacks execution order when callbacks make transactions (#26627).
  • Fixed HStoreField to raise a ValidationError instead of crashing on non-dictionary JSON input (#26672).
  • Fixed dbshell crash on PostgreSQL with an empty database name (#26698).
  • Fixed a regression in queries on a OneToOneField that has to_field and primary_key=True (#26667).

• Update to 1.9.6 Bugfixes

  • Added support for relative path redirects to the test client and to SimpleTestCase.assertRedirects() because Django 1.9 no longer converts redirects to absolute URIs (#26428).
  • Fixed TimeField microseconds round-tripping on MySQL and SQLite (#26498).
  • Prevented makemigrations from generating infinite migrations for a model field that references a functools.partial (#26475).
  • Fixed a regression where SessionBase.pop() returned None rather than raising a KeyError for nonexistent values (#26520).
  • Fixed a regression causing the cached template loader to crash when using template names starting with a dash (#26536).
  • Restored conversion of an empty string to null when saving values of GenericIPAddressField on SQLite and MySQL (#26557).
  • Fixed a makemessages…

This update for python-Django fixes the following issues:

• CVE-2023-36053: Fixed potential regular expression denial of service vulnerability in EmailValidator/URLValidator (boo#1212742)
• CVE-2023-24580: Fixed potential denial-of-service vulnerability in file uploads (boo#1208082)
• CVE-2023-23969: Fixed potential denial-of-service via Accept-Language headers (boo#1207565)
• CVE-2022-41323: Fixed potential denial-of-service vulnerability in internationalized URLs (boo#1203793)

These are all security issues fixed in the python310-Django-4.1.7-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Django4-4.2.14-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-Django-5.1.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python312-Django6-6.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django4-4.2.30-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Django5-5.2.16-1.1 package on the GA media of openSUSE Tumbleweed.

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

Rocky Enterprise Software Foundation Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring of multiple Linux deployments with a single centralized tool.

Security Fix(es):

• CVE-2022-1471 CVE-2022-25857 CVE-2022-38749 CVE-2022-38750 CVE-2022-38751 CVE-2022-38752 candlepin and puppetserver: various flaws
• CVE-2022-22577 tfm-rubygem-actionpack: rubygem-actionpack: Possible cross-site scripting vulnerability in Action Pack
• CVE-2022-23514 rubygem-loofah: inefficient regular expression leading to denial of service
• CVE-2022-23515 rubygem-loofah: rubygem-loofah: Improper neutralization of data URIs leading to Cross Site Scripting
• CVE-2022-23516 rubygem-loofah: Uncontrolled Recursion leading to denial of service
• CVE-2022-23517 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Inefficient Regular Expression leading to denial of service
• CVE-2022-23518 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Improper neutralization of data URIs leading to Cross site scripting
• CVE-2022-23519 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations
• CVE-2022-23520 tfm-rubygem-rails-html-sanitizer: rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations
• CVE-2022-27777 tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag helpers
• CVE-2022-31163 rubygem-tzinfo: rubygem-tzinfo: arbitrary code execution
• CVE-2022-32224 tfm-rubygem-activerecord: activerecord: Possible RCE escalation bug with Serialized Columns in Active Record
• CVE-2022-33980 candlepin: apache-commons-configuration2: Apache Commons Configuration insecure interpolation defaults
• CVE-2022-41323 satellite-capsule:el8/python-django: Potential denial-of-service vulnerability in internationalized URLs
• CVE-2022-41946 candlepin: postgresql-jdbc: Information leak of prepared statement data due to insecure temporary file permissions
• CVE-2022-42003 CVE-2022-42004 candlepin: various flaws
• CVE-2022-42889 candlepin: apache-commons-text: variable interpolation RCE
• CVE-2022-23514 rubygem-loofah: inefficient regular expression leading to denial of service
• CVE-2023-23969 python-django: Potential denial-of-service via Accept-Language headers
• CVE-2023-24580 python-django: Potential denial-of-service vulnerability in file uploads

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

The items above are not a complete list of changes. This update also fixes several bugs and adds various enhancements. Documentation for these changes is available from the Release Notes document.

This update for python-Django fixes the following issues:

• CVE-2023-24580: Fixed DOS in file uploads (bsc#1208082).

This update for python-Django1 fixes the following issues:

• CVE-2023-24580: Fixed potential DoS in file uploads (bsc#1208082).

Jakob Ackermann discovered that Django incorrectly handled certain file uploads. A remote attacker could possibly use this issue to cause Django to consume resources, leading to a denial of service.