critique
CVE-2023-31047
python-django: Potential bypass of validation when uploading multiple files using one form field
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, GHSA, Bitnami. Plus basse selon Red Hat (moyenne), Ubuntu (faible).
Description
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | django | 3.2.19, 4.1.9 |
| pip::GitHub Security Advisory pip | django | 3.2.19, 4.1.9, 4.2.1 |
| debian 10 | python-django | 1:1.11.29-1+deb10u8 |
| debian 11 | python-django | 2:2.2.28-1~deb11u2 |
| debian 12 | python-django | 3:3.2.19-1 |
| debian 13 | python-django | 3:3.2.19-1 |
| debian 14 | python-django | 3:3.2.19-1 |
| echo | python-django | 3:3.2.19-1 |
| Red Hat | python-django, python2-django | pas de correctif indiqué |
| ubuntu 14.04-ESM | python-django | 1.6.11-0ubuntu1.3+esm6 |
| ubuntu 16.04-ESM | python-django | 1.8.7-1ubuntu5.15+esm7 |
| ubuntu 18.04 | python-django | 1:1.11.11-1ubuntu1.21 |
Afficher les 19 entrées de 18 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | django | 3.2.19, 4.1.9 |
| pip::GitHub Security Advisory pip | django | 3.2.19, 4.1.9, 4.2.1 |
| debian 10 | python-django | 1:1.11.29-1+deb10u8 |
| debian 11 | python-django | 2:2.2.28-1~deb11u2 |
| debian 12 | python-django | 3:3.2.19-1 |
| debian 13 | python-django | 3:3.2.19-1 |
| debian 14 | python-django | 3:3.2.19-1 |
| echo | python-django | 3:3.2.19-1 |
| Red Hat | python-django | pas de correctif indiqué |
| Red Hat | python2-django | pas de correctif indiqué |
| ubuntu 14.04-ESM | python-django | 1.6.11-0ubuntu1.3+esm6 |
| ubuntu 16.04-ESM | python-django | 1.8.7-1ubuntu5.15+esm7 |
| ubuntu 18.04 | python-django | 1:1.11.11-1ubuntu1.21 |
| ubuntu 18.04-ESM | python-django | 1:1.11.11-1ubuntu1.21 |
| ubuntu 20.04 | python-django | 2:2.2.12-1ubuntu0.17 |
| ubuntu 20.04-ESM | python-django | 2:2.2.12-1ubuntu0.17 |
| ubuntu 22.04 | python-django | 2:3.2.12-2ubuntu1.6 |
| ubuntu 22.10 | python-django | 3:3.2.15-1ubuntu1.3 |
| ubuntu 23.04 | python-django | 3:3.2.18-1ubuntu0.1 |
Références
- https://access.redhat.com/security/cve/CVE-2023-31047
- https://docs.djangoproject.com/en/4.2/releases/security
- https://docs.djangoproject.com/en/4.2/releases/security/
- https://github.com/django/django
- https://github.com/django/django/commit/21b1b1fc03e5f9e9f8c977ee6e35618dd3b353dd
- https://github.com/django/django/commit/e7c3a2ccc3a562328600be05068ed9149e12ce64
- https://github.com/django/django/commit/eed53d0011622e70b936e203005f0e6f4ac48965
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-61.yaml
Les 22 références
- https://groups.google.com/forum/#!forum/django-announce
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNEHD6N435OE2XUFGDAAVAXSYWLCUBFD
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNEHD6N435OE2XUFGDAAVAXSYWLCUBFD/
- https://nvd.nist.gov/vuln/detail/CVE-2023-31047
- https://security.netapp.com/advisory/ntap-20230609-0008
- https://security.netapp.com/advisory/ntap-20230609-0008/
- https://ubuntu.com/security/notices/USN-6054-1
- https://ubuntu.com/security/notices/USN-6054-2
- https://www.cve.org/CVERecord?id=CVE-2023-31047
- https://www.djangoproject.com/weblog/2023/may/03/security-releases
- https://www.djangoproject.com/weblog/2023/may/03/security-releases/