Lucene search

PRIOn knowledge basePRION:CVE-2023-23969

HistoryFeb 01, 2023 - 7:15 p.m.

Code injection

2023-02-0119:15:00

PRIOn knowledge base

www.prio-n.com

django

code injection

security issue

denial-of-service

accept-language headers

7.3 High

AI Score

Confidence

High

0.009 Low

EPSS

Percentile

82.6%

JSON

In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.

CPENameOperatorVersion
debian_linuxeq10.0
djangoge4.1
djangolt4.1.6
djangoge4.0
djangolt4.0.9
djangoge3.2
djangolt3.2.17

Name	Operator	Version
debian_linux	eq	10.0
django	ge	4.1
django	lt	4.1.6
django	ge	4.0
django	lt	4.0.9
django	ge	3.2
django	lt	3.2.17

References

docs.djangoproject.com/en/4.1/releases/security/

groups.google.com/forum/

lists.debian.org/debian-lts-announce/2023/02/msg00000.html

lists.fedoraproject.org/archives/list/[email protected]/message/HWY6DQWRVBALV73BPUVBXC3QIYUM24IK/

lists.fedoraproject.org/archives/list/[email protected]/message/LTZVAKU5ALQWOKFTPISE257VCVIYGFQI/

security.netapp.com/advisory/ntap-20230302-0007/

www.djangoproject.com/weblog/2023/feb/01/security-releases/