Input validation error in Django - CVE-2023-23969

Vulnerability identifier: #VU71737

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-23969

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the Accept-Language headers. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Django
Debian Linux
Gentoo Linux
Oracle Solaris
openSUSE Leap
Ubuntu
openEuler
Fedora
python3-django (Ubuntu package)
python-django (Ubuntu package)
python3-Django
python-django-help
python-django
python-django (Debian package)
dev-python/django
Cloud Pak for Network Automation
Red Hat Update Infrastructure (RHUI)
Red Hat Satellite

Install updates from vendor's website.

Django - addressed in versions 3.2.17, 4.0.9, 4.1.6
python3-django (Ubuntu package) - addressed in versions Ubuntu Pro, 1:1.11.11-1ubuntu1.19, 2:2.2.12-1ubuntu0.15, 2:3.2.12-2ubuntu1.4, 3:3.2.15-1ubuntu1.1
python-django (Ubuntu package) - addressed in versions Ubuntu Pro, 1:1.11.11-1ubuntu1.19
python3-Django - update to 2.0.7-150000.1.20.1
python3-Django - addressed in versions 2.2.27-2, 2.2.27-3, 3.2.12-1, 3.2.12-2
python-django-help - addressed in versions 2.2.27-2, 2.2.27-3, 3.2.12-1, 3.2.12-2
python-django - addressed in versions 2.2.27-2, 2.2.27-3, 3.2.12-1, 3.2.12-2
python-django (Debian package) - addressed in versions 2:2.2.28-1~deb11u2, 3:3.2.19-1+deb12u1
Cloud Pak for Network Automation - update to 2.4.4
python-django - addressed in versions 4.0.10-1.fc37, 4.0.10-1.fc38
Red Hat Update Infrastructure (RHUI) - update to 4.4.0
dev-python/django - update to 5.2.1
Red Hat Satellite - update to 6.13

• https://www.djangoproject.com/weblog/2023/feb/01/security-releases/

• Denial of service in Django
• Ubuntu update for python-django
• Ubuntu update for python-django
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Oracle Solaris third-party software
• Multiple vulnerabilities in Red Hat Update Infrastructure (RHUI)
• Multiple vulnerabilities in Red Hat Satellite 6.13
• Debian update for python-django
• Fedora 38 update for python-django
• Fedora 37 update for python-django
• openEuler 20.03 LTS SP1 update for python-django
• openEuler 20.03 LTS SP3 update for python-django
• openEuler 22.03 LTS update for python-django
• openEuler 22.03 LTS SP1 update for python-django
• SUSE update for python-Django
• Gentoo update for Django