CVE-2022-23833

Name	CVE-2022-23833
Description	An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. Passing certain inputs to multipart forms could result in an infinite loop when parsing files.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2906-1, DLA-3191-1, DSA-5254-1, ELA-558-1
Debian Bugs	1004752

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-django (PTS)	jessie, jessie (lts)	1.7.11-1+deb8u17	fixed
	stretch (security)	1:1.10.7-2+deb9u17	fixed
	stretch (lts), stretch	1:1.10.7-2+deb9u23	fixed
	buster, buster (lts)	1:1.11.29-1+deb10u12	fixed
	buster (security)	1:1.11.29-1+deb10u11	fixed
	bullseye (security), bullseye	2:2.2.28-1~deb11u2	fixed
	bookworm (security), bookworm	3:3.2.19-1+deb12u1	fixed
	trixie	3:4.2.16-1	fixed
	sid	3:4.2.17-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
python-django	source	jessie	1.7.11-1+deb8u15	ELA-558-1
python-django	source	stretch	1:1.10.7-2+deb9u15	DLA-2906-1
python-django	source	buster	1:1.11.29-1+deb10u4	DLA-3191-1
python-django	source	bullseye	2:2.2.28-1~deb11u1	DSA-5254-1
python-django	source	(unstable)	2:3.2.12-1		1004752

Notes

https://www.djangoproject.com/weblog/2022/feb/01/security-releases/
https://github.com/django/django/commit/fc18f36c4ab94399366ca2f2007b3692559a6f23 (main)
https://github.com/django/django/commit/f9c7d48fdd6f198a6494a9202f90242f176e4fc9 (4.0.2)
https://github.com/django/django/commit/d16133568ef9c9b42cb7a08bdf9ff3feec2e5468 (3.2.12)
https://github.com/django/django/commit/c477b761804984c932704554ad35f78a2e230c6a (2.2.27)