Infinite loop in Django - CVE-2022-23833

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU60198

Infinite loop in Django - CVE-2022-23833

Published: February 1, 2022


Vulnerability identifier: #VU60198
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-23833
CWE-ID: CWE-835
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when parsing files. A remote attacker can upload a specially crafted file  to the server, consume all available system resources and cause denial of service conditions.


Affected software

Django
Gentoo Linux
Debian Linux
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
SUSE OpenStack Cloud
Oracle Solaris
Ubuntu
openEuler
Fedora
venv-openstack-octavia-x86_64
venv-openstack-monasca-ceilometer-x86_64
python-django (Ubuntu package)
python3-django (Ubuntu package)
python-Django1
python-Django
python-django20 (Red Hat package)
venv-openstack-monasca-x86_64
python3-Django
python-django-help
python-django
python-django (Debian package)
venv-openstack-swift-x86_64
venv-openstack-murano-x86_64
venv-openstack-freezer-x86_64
venv-openstack-barbican-x86_64
venv-openstack-magnum-x86_64
venv-openstack-designate-x86_64
venv-openstack-manila-x86_64
venv-openstack-aodh-x86_64
dev-python/django
venv-openstack-sahara-x86_64
venv-openstack-trove-x86_64
venv-openstack-ceilometer-x86_64
venv-openstack-heat-x86_64
venv-openstack-ironic-x86_64
venv-openstack-neutron-x86_64
venv-openstack-cinder-x86_64
venv-openstack-keystone-x86_64
venv-openstack-horizon-hpe-x86_64
venv-openstack-horizon-x86_64
venv-openstack-glance-x86_64
venv-openstack-nova-x86_64
Red Hat OpenStack

How to mitigate CVE-2022-23833

Install updates from vendor's website.

Django - addressed in versions 2.2.27, 3.2.12, 4.0.2
venv-openstack-octavia-x86_64 - addressed in versions 1.0.6~dev3-12.38.1, 3.2.3~dev7-4.30.1
venv-openstack-monasca-ceilometer-x86_64 - addressed in versions 1.5.1_1.5.1_1.5.1~dev3-8.33.1, 1.8.2~dev3-3.30.1
python-django (Ubuntu package) - addressed in versions 1.8.71ubuntu5.15+esm4, 1:1.11.11-1ubuntu1.16
python3-django (Ubuntu package) - addressed in versions 1.8.71ubuntu5.15+esm4, 1:1.11.11-1ubuntu1.16, 2:2.2.12-1ubuntu0.10, 2:2.2.24-1ubuntu1.3
python-Django1 - update to 1.11.29-3.37.1
python-Django - update to 1.11.29-3.39.1
python-django20 (Red Hat package) - update to 2.0.13-18.el8ost
venv-openstack-monasca-x86_64 - addressed in versions 2.2.2~dev1-11.40.1, 2.7.1~dev10-3.32.1
python3-Django - addressed in versions 2.2.27-1, 2.2.27-2
python-django-help - addressed in versions 2.2.27-1, 2.2.27-2
python-django - addressed in versions 2.2.27-1, 2.2.27-2
python-django (Debian package) - update to 2:2.2.28-1~deb11u1
venv-openstack-swift-x86_64 - addressed in versions 2.15.2_2.15.2_2.15.2~dev32-11.28.1, 2.19.2~dev48-2.25.1
python-django - addressed in versions 3.2.12-1.fc35, 4.0.2-1.fc36
venv-openstack-murano-x86_64 - update to 4.0.2~dev2-12.33.1
venv-openstack-freezer-x86_64 - update to 5.0.0.0~xrc2~dev2-10.33.1
venv-openstack-barbican-x86_64 - addressed in versions 5.0.2~dev3-12.38.1, 7.0.1~dev24-3.30.1
venv-openstack-magnum-x86_64 - addressed in versions 5.0.2_5.0.2_5.0.2~dev31-11.37.1, 7.2.1~dev1-4.30.1
venv-openstack-designate-x86_64 - addressed in versions 5.0.3~dev7-12.36.1, 7.0.2~dev2-3.30.1
venv-openstack-manila-x86_64 - addressed in versions 5.1.1~dev5-12.42.1, 7.4.2~dev60-3.36.1
venv-openstack-aodh-x86_64 - update to 5.1.1~dev7-12.37.1
dev-python/django - update to 5.2.1
venv-openstack-sahara-x86_64 - addressed in versions 7.0.5~dev4-11.37.1, 9.0.2~dev15-3.30.1
venv-openstack-trove-x86_64 - update to 8.0.2~dev2-11.37.1
venv-openstack-ceilometer-x86_64 - update to 9.0.8~dev7-12.35.1
venv-openstack-heat-x86_64 - addressed in versions 9.0.8~dev22-12.40.1, 11.0.4~dev4-3.30.1
venv-openstack-ironic-x86_64 - addressed in versions 9.1.8~dev8-12.38.1, 11.1.5~dev17-4.28.1
venv-openstack-neutron-x86_64 - addressed in versions 11.0.9~dev69-13.43.1, 13.0.8~dev164-6.34.1
venv-openstack-cinder-x86_64 - addressed in versions 11.2.3~dev29-14.39.1, 13.0.10~dev23-3.33.1
venv-openstack-keystone-x86_64 - addressed in versions 12.0.4~dev11-11.40.1, 14.2.1~dev7-3.31.1
venv-openstack-horizon-hpe-x86_64 - update to 12.0.5~dev6-14.43.2
venv-openstack-horizon-x86_64 - addressed in versions 12.0.5~dev6-14.43.2, 14.1.1~dev11-4.34.2
venv-openstack-glance-x86_64 - addressed in versions 15.0.3~dev3-12.36.1, 17.0.1~dev30-3.28.1
venv-openstack-nova-x86_64 - addressed in versions 16.1.9~dev92-11.41.1, 18.3.1~dev91-3.34.1
Red Hat OpenStack - addressed in versions 16.1.9, 16.2.4

External References

Related Security Bulletins