Summary
USN-5269-1 fixed several vulnerabilities in Django. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
Keryn Knight discovered that Django incorrectly handled certain template
tags. A remote attacker could possibly use this issue to perform a
cross-site scripting attack. (CVE-2022-22818)
Alan Ryan discovered that Django incorrectly handled file uploads. A remote
attacker could possibly use this issue to cause Django to hang, resulting
in a denial of service. (CVE-2022-23833)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | python-django | 1.6.11-0ubuntu1.3+esm4 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python-django | 1.8.7-1ubuntu5.15+esm4 |
Vulnerabilities 2
-
High 7.5CVE-2022-23833 EPSS 50%
Infinite Loop in Django
An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
-
Medium 6.1CVE-2022-22818 Public exploit
Cross-site Scripting in Django
The {% debug %} template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.