mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 06:06:09 +00:00
Code Issues 32 Releases Wiki Activity

Fixed CVE-2022-23833 -- Fixed DoS possiblity in file uploads.

Browse Source 
Thanks Alan Ryan for the report and initial patch.
This commit is contained in:
Mariusz Felisiak
2022-01-21 07:50:03 +01:00
parent 394517f078
commit fc18f36c4a
5 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/releases/2.2.27.txt
View File

@@ -15,3 +15,9 @@ posing an XSS attack vector.
In order to avoid this vulnerability, ``{% debug %}`` no longer outputs an
information when the ``DEBUG`` setting is ``False``, and it ensures all context
variables are correctly escaped when the ``DEBUG`` setting is ``True``.
CVE-2022-23833: Denial-of-service possibility in file uploads
=============================================================
Passing certain inputs to multipart forms could result in an infinite loop when
parsing files.

6
docs/releases/3.2.12.txt
View File

@@ -15,3 +15,9 @@ posing an XSS attack vector.
In order to avoid this vulnerability, ``{% debug %}`` no longer outputs an
information when the ``DEBUG`` setting is ``False``, and it ensures all context
variables are correctly escaped when the ``DEBUG`` setting is ``True``.
CVE-2022-23833: Denial-of-service possibility in file uploads
=============================================================
Passing certain inputs to multipart forms could result in an infinite loop when
parsing files.

6
docs/releases/4.0.2.txt
View File

@@ -18,6 +18,12 @@ In order to avoid this vulnerability, ``{% debug %}`` no longer outputs an
information when the ``DEBUG`` setting is ``False``, and it ensures all context
variables are correctly escaped when the ``DEBUG`` setting is ``True``.
CVE-2022-23833: Denial-of-service possibility in file uploads
=============================================================
Passing certain inputs to multipart forms could result in an infinite loop when
parsing files.
Bugfixes
========