kritik
CVE-2023-31047
python-django: Potential bypass of validation when uploading multiple files using one form field
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, GHSA, Bitnami. Daha düşük diyenler: Red Hat (orta), Ubuntu (düşük).
Açıklama
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | django | 3.2.19, 4.1.9 |
| pip::GitHub Security Advisory pip | django | 3.2.19, 4.1.9, 4.2.1 |
| debian 10 | python-django | 1:1.11.29-1+deb10u8 |
| debian 11 | python-django | 2:2.2.28-1~deb11u2 |
| debian 12 | python-django | 3:3.2.19-1 |
| debian 13 | python-django | 3:3.2.19-1 |
| debian 14 | python-django | 3:3.2.19-1 |
| echo | python-django | 3:3.2.19-1 |
| Red Hat | python-django, python2-django | düzeltme belirtilmemiş |
| ubuntu 14.04-ESM | python-django | 1.6.11-0ubuntu1.3+esm6 |
| ubuntu 16.04-ESM | python-django | 1.8.7-1ubuntu5.15+esm7 |
| ubuntu 18.04 | python-django | 1:1.11.11-1ubuntu1.21 |
18 kaynaktaki 19 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | django | 3.2.19, 4.1.9 |
| pip::GitHub Security Advisory pip | django | 3.2.19, 4.1.9, 4.2.1 |
| debian 10 | python-django | 1:1.11.29-1+deb10u8 |
| debian 11 | python-django | 2:2.2.28-1~deb11u2 |
| debian 12 | python-django | 3:3.2.19-1 |
| debian 13 | python-django | 3:3.2.19-1 |
| debian 14 | python-django | 3:3.2.19-1 |
| echo | python-django | 3:3.2.19-1 |
| Red Hat | python-django | düzeltme belirtilmemiş |
| Red Hat | python2-django | düzeltme belirtilmemiş |
| ubuntu 14.04-ESM | python-django | 1.6.11-0ubuntu1.3+esm6 |
| ubuntu 16.04-ESM | python-django | 1.8.7-1ubuntu5.15+esm7 |
| ubuntu 18.04 | python-django | 1:1.11.11-1ubuntu1.21 |
| ubuntu 18.04-ESM | python-django | 1:1.11.11-1ubuntu1.21 |
| ubuntu 20.04 | python-django | 2:2.2.12-1ubuntu0.17 |
| ubuntu 20.04-ESM | python-django | 2:2.2.12-1ubuntu0.17 |
| ubuntu 22.04 | python-django | 2:3.2.12-2ubuntu1.6 |
| ubuntu 22.10 | python-django | 3:3.2.15-1ubuntu1.3 |
| ubuntu 23.04 | python-django | 3:3.2.18-1ubuntu0.1 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2023-31047
- https://docs.djangoproject.com/en/4.2/releases/security
- https://docs.djangoproject.com/en/4.2/releases/security/
- https://github.com/django/django
- https://github.com/django/django/commit/21b1b1fc03e5f9e9f8c977ee6e35618dd3b353dd
- https://github.com/django/django/commit/e7c3a2ccc3a562328600be05068ed9149e12ce64
- https://github.com/django/django/commit/eed53d0011622e70b936e203005f0e6f4ac48965
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-61.yaml
22 referansın hepsi
- https://groups.google.com/forum/#!forum/django-announce
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A45VKTUVQ2BN6D5ZLZGCM774R6QGFOHW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNEHD6N435OE2XUFGDAAVAXSYWLCUBFD
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNEHD6N435OE2XUFGDAAVAXSYWLCUBFD/
- https://nvd.nist.gov/vuln/detail/CVE-2023-31047
- https://security.netapp.com/advisory/ntap-20230609-0008
- https://security.netapp.com/advisory/ntap-20230609-0008/
- https://ubuntu.com/security/notices/USN-6054-1
- https://ubuntu.com/security/notices/USN-6054-2
- https://www.cve.org/CVERecord?id=CVE-2023-31047
- https://www.djangoproject.com/weblog/2023/may/03/security-releases
- https://www.djangoproject.com/weblog/2023/may/03/security-releases/