Lucene search
Veracode Vulnerability DatabaseVERACODE:39272HistoryFeb 15, 2023 - 3:04 a.m.
Denial Of Service (DoS)
2023-02-1503:04:41
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
17
django
denial of service
vulnerability
memory exhaustion
application crash
EPSS
0.004
Percentile
72.4%
Django is vulnerable to Denial Of Service (DoS). The vulnerability exists because the library does not limit the maximum number of files encoded in a multipart upload which can lead to memory exhaustion, allowing an attacker to cause an application crash.
Affected configurations
Node
-py3-django\Matchedge3.2.13-r0
OR-py3-django\Matchedge3.1.13-r1
OR-py3-django\Matchedge3.1.7-r1
OR-py3-django\Matchedge3.2.16-r0
OR-py3-django\Matchedge3.1.7-r0
OR-py3-django\Matchedge3.2.14-r0
OR-py3-django\Matchedge1.11.28-r0
OR-py3-django\Matchedge3.1.13-r0
OR-py3-django\Matchedge3.2.12-r0
OR-py3-django\Matchedge3.2.17-r0
OR-py3-django\Matchedge1.11.29-r0
OR-py3-django\Matchedge3.1.8-r0
OR-py3-django\Matchedge3.2.16-r1
OR-py3-django\Matchedge3.2.15-r0
OR-py3-django\Match3.173.2.16-r0
OR-py3-django\Match3.173.2.17-r0
OR-python-django\Matchbionic1\1.11.11-1ubuntu1.14
OR-python-django\Matchbionic1\1.11.11-1ubuntu1
OR-python-django\Matchbionic1\1.11.11-1ubuntu1.9
OR-python-django\Matchbuster1\1.11.29-1~deb10u1
OR-python-djangoMatch2.2.9_1.el8
OR-python-djangoMatch2.2.19_1.el8
OR-python-djangoMatch3.2.14_3.el8ui
OR-python-djangoMatch2.2.24_1.el8ui
OR-python-djangoMatch2.1.11_1.el8ost
OR-python-djangoMatch3.2.14_1.el8pc
OR-python-djangoMatch2.2.17_1.el8pc
OR-python-djangoMatch3.2.13_1.el8pc
OR-python-djangoMatch2.1.7_1.el8d
OR-python-djangoMatch2.2.13_1.el8
OR-python-djangoMatch2.2.24_1.el8
OR-python-djangoMatch2.2.3_1.epel8.playground
OR-python-djangoMatch3.2.16_1.0.1.el8ui
OR-python-djangoMatch3.2.13_4.el8pc
OR-python-djangoMatch2.2.9_1.epel8.playground
OR-python-djangoMatch2.2.3_1.el8
OR-python-djangoMatch2.2.17_1.el8
OR-python-djangoMatch2.2.13_1.epel8.playground
OR-python-djangoMatch2.0.10_1.el8ost
OR-python-djangoMatch3.2.13_2.el8ui
OR-python-djangoMatch3.2.9_3.el8ui
OR-python-djangoMatch3.2.14_2.el8pc
OR-python-djangoMatch3.2.7_4.el8pc
OR-python-djangoMatch3.2.16_1.el8pc
OR-automation-controllerMatch4.2.0_2.el8ap
OR-automation-controllerMatch4.3.1_1.el9ap
OR-automation-controllerMatch4.3.2_1.el9ap
OR-automation-controllerMatch4.2.2_1.el8ap
OR-automation-controllerMatch4.2.0_2.el9ap
OR-automation-controllerMatch4.4.0_1.el8ap
OR-automation-controllerMatch4.4.1_1.el9ap
OR-automation-controllerMatch4.2.0_3.el9ap
OR-automation-controllerMatch4.2.0_3.el8ap
OR-automation-controllerMatch4.3.13_1.el8ap
OR-automation-controllerMatch4.3.11_1.el9ap
OR-automation-controllerMatch4.3.8_1.el8ap
OR-automation-controllerMatch4.3.1_1.el8ap
OR-automation-controllerMatch4.4.1_1.el8ap
OR-automation-controllerMatch4.2.0_4.el8ap
OR-automation-controllerMatch4.3.5_1.el8ap
OR-automation-controllerMatch4.3.4_1.el9ap
OR-automation-controllerMatch4.2.1_1.el8ap
OR-automation-controllerMatch4.3.0_2.el8ap
OR-automation-controllerMatch4.3.15_1.el8ap
OR-automation-controllerMatch4.3.13_1.el9ap
OR-automation-controllerMatch4.3.9_1.el8ap
OR-automation-controllerMatch4.3.12_1.el8ap
OR-automation-controllerMatch4.3.15_1.el9ap
OR-automation-controllerMatch4.1.4_1.el8ap
OR-automation-controllerMatch4.1.3_2.el8ap
OR-automation-controllerMatch4.3.10_1.el8ap
OR-automation-controllerMatch4.3.7_1.el8ap
OR-automation-controllerMatch4.3.11_1.el8ap
OR-automation-controllerMatch4.1.2_2.el8ap
OR-automation-controllerMatch4.2.1_1.el9ap
OR-automation-controllerMatch4.1.0_2.el8ap
OR-automation-controllerMatch4.3.14_1.el8ap
OR-automation-controllerMatch4.1.1_2.el8ap
OR-automation-controllerMatch4.3.3_1.el9ap
OR-automation-controllerMatch4.3.10_1.el9ap
OR-automation-controllerMatch4.3.7_1.el9ap
OR-automation-controllerMatch4.0.1_1.el8ap
OR-automation-controllerMatch4.4.0_1.el9ap
OR-automation-controllerMatch4.3.5_1.el9ap
OR-automation-controllerMatch4.3.6_1.el9ap
OR-automation-controllerMatch4.3.8_1.el9ap
OR-automation-controllerMatch4.2.2_1.el9ap
OR-automation-controllerMatch4.2.2_3.el8ap
OR-automation-controllerMatch4.3.3_1.el8ap
OR-automation-controllerMatch4.2.2_3.el9ap
OR-automation-controllerMatch4.3.12_1.el9ap
OR-automation-controllerMatch4.3.14_1.el9ap
OR-automation-controllerMatch4.3.2_1.el8ap
OR-automation-controllerMatch4.3.0_2.el9ap
OR-automation-controllerMatch4.2.0_6.el9ap
OR-automation-controllerMatch4.3.6_1.el8ap
OR-automation-controllerMatch4.2.0_4.el9ap
OR-automation-controllerMatch4.1.2_1.el8ap
OR-automation-controllerMatch4.3.4_1.el8ap
OR-automation-controllerMatch4.3.9_1.el9ap
OR-automation-controllerMatch4.0.0_1.el8ap
OR-automation-controllerMatch4.2.0_6.el8ap
OR-py3-django\Matchedge3.2.13-r0
OR-py3-django\Matchedge3.1.13-r1
OR-py3-django\Matchedge3.1.7-r1
OR-py3-django\Matchedge3.2.16-r0
OR-py3-django\Matchedge3.1.7-r0
OR-py3-django\Matchedge3.2.14-r0
OR-py3-django\Matchedge1.11.28-r0
OR-py3-django\Matchedge3.1.13-r0
OR-py3-django\Matchedge3.2.12-r0
OR-py3-django\Matchedge3.2.17-r0
OR-py3-django\Matchedge1.11.29-r0
OR-py3-django\Matchedge3.1.8-r0
OR-py3-django\Matchedge3.2.16-r1
OR-py3-django\Matchedge3.2.15-r0
OR-py3-django\Match3.173.2.16-r0
OR-py3-django\Match3.173.2.17-r0
OR-python-django\Matchbionic1\1.11.11-1ubuntu1.14
OR-python-django\Matchbionic1\1.11.11-1ubuntu1
OR-python-django\Matchbionic1\1.11.11-1ubuntu1.9
OR-python-django\Matchbuster1\1.11.29-1~deb10u1
OR-python-djangoMatch2.2.9_1.el8
OR-python-djangoMatch2.2.19_1.el8
OR-python-djangoMatch3.2.14_3.el8ui
OR-python-djangoMatch2.2.24_1.el8ui
OR-python-djangoMatch2.1.11_1.el8ost
OR-python-djangoMatch3.2.14_1.el8pc
OR-python-djangoMatch2.2.17_1.el8pc
OR-python-djangoMatch3.2.13_1.el8pc
OR-python-djangoMatch2.1.7_1.el8d
OR-python-djangoMatch2.2.13_1.el8
OR-python-djangoMatch2.2.24_1.el8
OR-python-djangoMatch2.2.3_1.epel8.playground
OR-python-djangoMatch3.2.16_1.0.1.el8ui
OR-python-djangoMatch3.2.13_4.el8pc
OR-python-djangoMatch2.2.9_1.epel8.playground
OR-python-djangoMatch2.2.3_1.el8
OR-python-djangoMatch2.2.17_1.el8
OR-python-djangoMatch2.2.13_1.epel8.playground
OR-python-djangoMatch2.0.10_1.el8ost
OR-python-djangoMatch3.2.13_2.el8ui
OR-python-djangoMatch3.2.9_3.el8ui
OR-python-djangoMatch3.2.14_2.el8pc
OR-python-djangoMatch3.2.7_4.el8pc
OR-python-djangoMatch3.2.16_1.el8pc
OR-automation-controllerMatch4.2.0_2.el8ap
OR-automation-controllerMatch4.3.1_1.el9ap
OR-automation-controllerMatch4.3.2_1.el9ap
OR-automation-controllerMatch4.2.2_1.el8ap
OR-automation-controllerMatch4.2.0_2.el9ap
OR-automation-controllerMatch4.4.0_1.el8ap
OR-automation-controllerMatch4.4.1_1.el9ap
OR-automation-controllerMatch4.2.0_3.el9ap
OR-automation-controllerMatch4.2.0_3.el8ap
OR-automation-controllerMatch4.3.13_1.el8ap
OR-automation-controllerMatch4.3.11_1.el9ap
OR-automation-controllerMatch4.3.8_1.el8ap
OR-automation-controllerMatch4.3.1_1.el8ap
OR-automation-controllerMatch4.4.1_1.el8ap
OR-automation-controllerMatch4.2.0_4.el8ap
OR-automation-controllerMatch4.3.5_1.el8ap
OR-automation-controllerMatch4.3.4_1.el9ap
OR-automation-controllerMatch4.2.1_1.el8ap
OR-automation-controllerMatch4.3.0_2.el8ap
OR-automation-controllerMatch4.3.15_1.el8ap
OR-automation-controllerMatch4.3.13_1.el9ap
OR-automation-controllerMatch4.3.9_1.el8ap
OR-automation-controllerMatch4.3.12_1.el8ap
OR-automation-controllerMatch4.3.15_1.el9ap
OR-automation-controllerMatch4.1.4_1.el8ap
OR-automation-controllerMatch4.1.3_2.el8ap
OR-automation-controllerMatch4.3.10_1.el8ap
OR-automation-controllerMatch4.3.7_1.el8ap
OR-automation-controllerMatch4.3.11_1.el8ap
OR-automation-controllerMatch4.1.2_2.el8ap
OR-automation-controllerMatch4.2.1_1.el9ap
OR-automation-controllerMatch4.1.0_2.el8ap
OR-automation-controllerMatch4.3.14_1.el8ap
OR-automation-controllerMatch4.1.1_2.el8ap
OR-automation-controllerMatch4.3.3_1.el9ap
OR-automation-controllerMatch4.3.10_1.el9ap
OR-automation-controllerMatch4.3.7_1.el9ap
OR-automation-controllerMatch4.0.1_1.el8ap
OR-automation-controllerMatch4.4.0_1.el9ap
OR-automation-controllerMatch4.3.5_1.el9ap
OR-automation-controllerMatch4.3.6_1.el9ap
OR-automation-controllerMatch4.3.8_1.el9ap
OR-automation-controllerMatch4.2.2_1.el9ap
OR-automation-controllerMatch4.2.2_3.el8ap
OR-automation-controllerMatch4.3.3_1.el8ap
OR-automation-controllerMatch4.2.2_3.el9ap
OR-automation-controllerMatch4.3.12_1.el9ap
OR-automation-controllerMatch4.3.14_1.el9ap
OR-automation-controllerMatch4.3.2_1.el8ap
OR-automation-controllerMatch4.3.0_2.el9ap
OR-automation-controllerMatch4.2.0_6.el9ap
OR-automation-controllerMatch4.3.6_1.el8ap
OR-automation-controllerMatch4.2.0_4.el9ap
OR-automation-controllerMatch4.1.2_1.el8ap
OR-automation-controllerMatch4.3.4_1.el8ap
OR-automation-controllerMatch4.3.9_1.el9ap
OR-automation-controllerMatch4.0.0_1.el8ap
OR-automation-controllerMatch4.2.0_6.el8ap
ORdjangoprojectdjangoRange≤3.2.17
ORdjangoprojectdjangoRange≤4.1.6
| Vendor | Product | Version | CPE |
|---|---|---|---|
| - | py3-django\ | edge | cpe:2.3:a:-:py3-django\:edge:3.2.13-r0:*:*:*:*:*:*:* |
| - | py3-django\ | edge | cpe:2.3:a:-:py3-django\:edge:3.1.13-r1:*:*:*:*:*:*:* |
| - | py3-django\ | edge | cpe:2.3:a:-:py3-django\:edge:3.1.7-r1:*:*:*:*:*:*:* |
| - | py3-django\ | edge | cpe:2.3:a:-:py3-django\:edge:3.2.16-r0:*:*:*:*:*:*:* |
| - | py3-django\ | edge | cpe:2.3:a:-:py3-django\:edge:3.1.7-r0:*:*:*:*:*:*:* |
| - | py3-django\ | edge | cpe:2.3:a:-:py3-django\:edge:3.2.14-r0:*:*:*:*:*:*:* |
| - | py3-django\ | edge | cpe:2.3:a:-:py3-django\:edge:1.11.28-r0:*:*:*:*:*:*:* |
| - | py3-django\ | edge | cpe:2.3:a:-:py3-django\:edge:3.1.13-r0:*:*:*:*:*:*:* |
| - | py3-django\ | edge | cpe:2.3:a:-:py3-django\:edge:3.2.12-r0:*:*:*:*:*:*:* |
| - | py3-django\ | edge | cpe:2.3:a:-:py3-django\:edge:3.2.17-r0:*:*:*:*:*:*:* |
References
www.openwall.com/lists/oss-security/2023/02/14/1
django.readthedocs.io/en/latest/releases/security.html#february-14-2023-cve-2023-24580
docs.djangoproject.com/en/4.1/releases/security/
github.com/django/django/commit/628b33a854a9c68ec8a0c51f382f304a0044ec92
github.com/django/django/commit/83f1ea83e4553e211c1c5a0dfc197b66d4e50432
github.com/django/django/commit/a665ed5179f5bbd3db95ce67286d0192eff041d8
github.com/django/django/pull/15071
groups.google.com/forum/#!forum/django-announce
groups.google.com/forum/#%21forum/django-announce
lists.debian.org/debian-lts-announce/2023/02/msg00023.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP/
lists.fedoraproject.org/archives/list/[email protected]/message/FKYVMMR7RPM6AHJ2SBVM2LO6D3NGFY7B/
lists.fedoraproject.org/archives/list/[email protected]/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/
lists.fedoraproject.org/archives/list/[email protected]/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/
lists.fedoraproject.org/archives/list/[email protected]/message/VZS4G6NSZWPTVXMMZHJOJVQEPL3QTO77/
lists.fedoraproject.org/archives/list/[email protected]/message/YJB6FUBBLVKKG655UMTLQNN6UQ6EDLSP/
security.netapp.com/advisory/ntap-20230316-0006/
www.djangoproject.com/weblog/2023/feb/14/security-releases/
Related
debiancve
debiancve
CVE-2023-24580
2023-02-15 01:15:10
nessus
nessus
Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Django vulnerability (USN-5868-1)
2023-02-15 00:00:00
openSUSE 15 Security Update : python-Django (openSUSE-SU-2023:0075-1)
2023-03-15 00:00:00
Debian DLA-3329-1 : python-django - LTS security update
2023-02-20 00:00:00
prion
prion
Design/Logic Flaw
2023-02-15 01:15:00
osv
osv
CVE-2023-24580
2023-02-15 01:15:10
python-django - security update
2023-02-20 00:00:00
Resource exhaustion in Django
2023-02-15 03:30:47
redhatcve
redhatcve
CVE-2023-24580
2023-02-15 07:32:10
cvelist
cvelist
CVE-2023-24580
2023-02-15 00:00:00
nvd
nvd
CVE-2023-24580
2023-02-15 01:15:10
CVE-2022-24580
2023-05-29 20:15:09
hackerone
hackerone
openvas
openvas
Debian: Security Advisory (DLA-3329-1)
2023-02-21 00:00:00
openSUSE: Security Advisory for python (openSUSE-SU-2023:0075-1)
2024-03-04 00:00:00
debian
debian
[SECURITY] [DLA 3329-1] python-django security update
2023-02-20 21:02:30
[SECURITY] [DSA 5465-1] python-django security update
2023-08-03 20:45:41
freebsd
freebsd
Django -- multiple vulnerabilities
2023-02-01 00:00:00
alpinelinux
alpinelinux
CVE-2023-24580
2023-02-15 01:15:10
ubuntucve
ubuntucve
CVE-2023-24580
2023-02-14 00:00:00
github
github
Resource exhaustion in Django
2023-02-15 03:30:47
ubuntu
ubuntu
Django vulnerability
2023-02-14 00:00:00
cve
cve
CVE-2023-24580
2023-02-15 01:15:10
CVE-2022-24580
2023-05-29 20:15:09
redhat
redhat
(RHSA-2023:4692) Moderate: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
2023-08-21 17:00:46
(RHSA-2023:2101) Moderate: RHUI 4.4.0 release - Security Fixes, Bug Fixes, and Enhancements Update
2023-05-03 14:52:25
(RHSA-2023:2097) Important: Satellite 6.13 Release
2023-05-03 13:09:51
mageia
mageia
Updated python-django packages fix security vulnerability
2023-05-16 22:17:40
altlinux
altlinux
fedora
fedora
[SECURITY] Fedora 36 Update: python-django3-3.2.18-1.fc36
2023-03-05 00:54:12
[SECURITY] Fedora 37 Update: python-django3-3.2.18-1.fc37
2023-03-05 01:38:46
[SECURITY] Fedora 38 Update: python-django3-3.2.18-1.fc38
2023-03-11 03:40:03
ibm
ibm
rocky
rocky
Satellite 6.13 Release
2023-05-05 15:39:58