Input validation error in Django - CVE-2022-41323

Vulnerability identifier: #VU67893

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-41323

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input passed via the locale parameter in internationalized URLs. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Django
Debian Linux
Gentoo Linux
Fedora
Ubuntu
python3-django (Ubuntu package)
python-django (Debian package)
python-django3
python-django
dev-python/django
Red Hat Update Infrastructure (RHUI)
Red Hat Satellite

Install updates from vendor's website.

Django - addressed in versions 3.2.16, 4.0.8, 4.1.2
python3-django (Ubuntu package) - addressed in versions 2:2.2.12-1ubuntu0.14, 2:3.2.12-2ubuntu1.3
python-django (Debian package) - update to 2:2.2.28-1~deb11u1
python-django3 - addressed in versions 3.2.18-1.el8, 3.2.18-1.fc36, 3.2.18-1.fc37, 3.2.18-1.fc38
python-django - addressed in versions 4.0.10-1.fc37, 4.0.10-1.fc38
Red Hat Update Infrastructure (RHUI) - update to 4.3.0
dev-python/django - update to 5.2.1
Red Hat Satellite - update to 6.13

• https://www.djangoproject.com/weblog/2022/oct/04/security-releases/

• Denial of service in Django
• Ubuntu update for python-django
• Debian update for python-django
• Multiple vulnerabilities in Red Hat Satellite 6.13
• Multiple vulnerabilties in Red Hat Update Infrastructure (RHUI)
• Fedora 37 update for python-django3
• Fedora 36 update for python-django3
• Fedora EPEL 8 update for python-django3
• Fedora 38 update for python-django3
• Fedora 38 update for python-django
• Fedora 37 update for python-django
• Gentoo update for Django