mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 14:16:09 +00:00
Code Issues 32 Releases Wiki Activity

[4.2.x] Fixed CVE-2023-24580 -- Prevented DoS with too many uploaded files.

Browse Source 
Thanks to Jakob Ackermann for the report.
This commit is contained in:
Markus Holtermann
2022-12-13 10:27:39 +01:00
committed by Carlton Gibson
parent de42d51361
commit 7ac5ff37b8
12 changed files with 213 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/ref/exceptions.txt
View File

@@ -95,12 +95,17 @@ Django core exception classes are defined in ``django.core.exceptions``.
* ``SuspiciousMultipartForm``
* ``SuspiciousSession``
* ``TooManyFieldsSent``
* ``TooManyFilesSent``
If a ``SuspiciousOperation`` exception reaches the ASGI/WSGI handler level
it is logged at the ``Error`` level and results in
a :class:`~django.http.HttpResponseBadRequest`. See the :doc:`logging
documentation </topics/logging/>` for more information.
.. versionchanged:: 3.2.18
``SuspiciousOperation`` is raised when too many files are submitted.
``PermissionDenied``
--------------------

23
docs/ref/settings.txt
View File

@@ -1097,6 +1097,28 @@ could be used as a denial-of-service attack vector if left unchecked. Since web
servers don't typically perform deep request inspection, it's not possible to
perform a similar check at that level.
.. setting:: DATA_UPLOAD_MAX_NUMBER_FILES
``DATA_UPLOAD_MAX_NUMBER_FILES``
--------------------------------
.. versionadded:: 3.2.18
Default: ``100``
The maximum number of files that may be received via POST in a
``multipart/form-data`` encoded request before a
:exc:`~django.core.exceptions.SuspiciousOperation` (``TooManyFiles``) is
raised. You can set this to ``None`` to disable the check. Applications that
are expected to receive an unusually large number of file fields should tune
this setting.
The number of accepted files is correlated to the amount of time and memory
needed to process the request. Large requests could be used as a
denial-of-service attack vector if left unchecked. Since web servers don't
typically perform deep request inspection, it's not possible to perform a
similar check at that level.
.. setting:: DATABASE_ROUTERS
``DATABASE_ROUTERS``
@@ -3775,6 +3797,7 @@ HTTP
----
* :setting:`DATA_UPLOAD_MAX_MEMORY_SIZE`
* :setting:`DATA_UPLOAD_MAX_NUMBER_FIELDS`
* :setting:`DATA_UPLOAD_MAX_NUMBER_FILES`
* :setting:`DEFAULT_CHARSET`
* :setting:`DISALLOWED_USER_AGENTS`
* :setting:`FORCE_SCRIPT_NAME`

10
docs/releases/3.2.18.txt
View File

@@ -6,4 +6,12 @@ Django 3.2.18 release notes
Django 3.2.18 fixes a security issue with severity "moderate" in 3.2.17.
...
CVE-2023-24580: Potential denial-of-service vulnerability in file uploads
=========================================================================
Passing certain inputs to multipart forms could result in too many open files
or memory exhaustion, and provided a potential vector for a denial-of-service
attack.
The number of files parts parsed is now limited via the new
:setting:`DATA_UPLOAD_MAX_NUMBER_FILES` setting.

10
docs/releases/4.0.10.txt
View File

@@ -6,4 +6,12 @@ Django 4.0.10 release notes
Django 4.0.10 fixes a security issue with severity "moderate" in 4.0.9.
...
CVE-2023-24580: Potential denial-of-service vulnerability in file uploads
=========================================================================
Passing certain inputs to multipart forms could result in too many open files
or memory exhaustion, and provided a potential vector for a denial-of-service
attack.
The number of files parts parsed is now limited via the new
:setting:`DATA_UPLOAD_MAX_NUMBER_FILES` setting.

14
docs/releases/4.1.7.txt
View File

@@ -4,10 +4,18 @@ Django 4.1.7 release notes
*February 14, 2023*
Django 4.1.7 fixes a security issue with severity "moderate" and several bugs
in 4.1.6.
Django 4.1.7 fixes a security issue with severity "moderate" and a bug in
4.1.6.
...
CVE-2023-24580: Potential denial-of-service vulnerability in file uploads
=========================================================================
Passing certain inputs to multipart forms could result in too many open files
or memory exhaustion, and provided a potential vector for a denial-of-service
attack.
The number of files parts parsed is now limited via the new
:setting:`DATA_UPLOAD_MAX_NUMBER_FILES` setting.
Bugfixes
========