Django-3.2.15-py3-none-any.whl: 5 vulnerabilities (highest severity is: 9.8)

[mend-bolt-for-github]

Vulnerable Library - Django-3.2.15-py3-none-any.whl

A high-level Python web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl

Path to dependency file: /requirements/requirements.txt

Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (Django version)	Remediation Possible**
CVE-2023-31047	Critical	9.8	Django-3.2.15-py3-none-any.whl	Direct	Django - 3.2.19,4.1.9,4.2.1	❌
CVE-2023-36053	High	7.5	Django-3.2.15-py3-none-any.whl	Direct	Django -3.2.20,4.1.10,4.2.3	❌
CVE-2023-24580	High	7.5	Django-3.2.15-py3-none-any.whl	Direct	Django - 3.2.18,4.0.10,4.1.7	❌
CVE-2023-23969	High	7.5	Django-3.2.15-py3-none-any.whl	Direct	django - 3.2.17, 4.0.9, 4.1.6	❌
CVE-2022-41323	High	7.5	Django-3.2.15-py3-none-any.whl	Direct	Django - 3.2.16,4.0.8,4.1.2	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-31047

Vulnerable Library - Django-3.2.15-py3-none-any.whl

A high-level Python web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl

Path to dependency file: /requirements/requirements.txt

Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt

Dependency Hierarchy:

• ❌ Django-3.2.15-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.

Publish Date: 2023-05-07

URL: CVE-2023-31047

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://seclists.org/oss-sec/2023/q2/110

Release Date: 2023-05-07

Fix Resolution: Django - 3.2.19,4.1.9,4.2.1

Step up your Open Source Security Game with Mend here

CVE-2023-36053

Vulnerable Library - Django-3.2.15-py3-none-any.whl

A high-level Python web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl

Path to dependency file: /requirements/requirements.txt

Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt

Dependency Hierarchy:

• ❌ Django-3.2.15-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.

Publish Date: 2023-07-03

URL: CVE-2023-36053

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://seclists.org/oss-sec/2023/q3/2

Release Date: 2023-07-03

Fix Resolution: Django -3.2.20,4.1.10,4.2.3

Step up your Open Source Security Game with Mend here

CVE-2023-24580

Vulnerable Library - Django-3.2.15-py3-none-any.whl

A high-level Python web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl

Path to dependency file: /requirements/requirements.txt

Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt

Dependency Hierarchy:

• ❌ Django-3.2.15-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.

Publish Date: 2023-02-15

URL: CVE-2023-24580

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://seclists.org/oss-sec/2023/q1/93

Release Date: 2023-02-15

Fix Resolution: Django - 3.2.18,4.0.10,4.1.7

Step up your Open Source Security Game with Mend here

CVE-2023-23969

Vulnerable Library - Django-3.2.15-py3-none-any.whl

A high-level Python web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl

Path to dependency file: /requirements/requirements.txt

Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt

Dependency Hierarchy:

• ❌ Django-3.2.15-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.

Publish Date: 2023-02-01

URL: CVE-2023-23969

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.djangoproject.com/weblog/2023/feb/01/security-releases/

Release Date: 2023-02-01

Fix Resolution: django - 3.2.17, 4.0.9, 4.1.6

Step up your Open Source Security Game with Mend here

CVE-2022-41323

Vulnerable Library - Django-3.2.15-py3-none-any.whl

A high-level Python web framework that encourages rapid development and clean, pragmatic design.

Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl

Path to dependency file: /requirements/requirements.txt

Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt

Dependency Hierarchy:

• ❌ Django-3.2.15-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.

Publish Date: 2022-10-16

URL: CVE-2022-41323

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41323

Release Date: 2022-10-16

Fix Resolution: Django - 3.2.16,4.0.8,4.1.2

Step up your Open Source Security Game with Mend here