Vulnerable Library - Django-3.2.15-py3-none-any.whl
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl
Path to dependency file: /requirements/requirements.txt
Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt
Vulnerabilities
| CVE |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (Django version) |
Remediation Possible** |
| CVE-2023-31047 |
 Critical |
9.8 |
Django-3.2.15-py3-none-any.whl |
Direct |
Django - 3.2.19,4.1.9,4.2.1 |
❌ |
| CVE-2023-36053 |
 High |
7.5 |
Django-3.2.15-py3-none-any.whl |
Direct |
Django -3.2.20,4.1.10,4.2.3 |
❌ |
| CVE-2023-24580 |
High |
7.5 |
Django-3.2.15-py3-none-any.whl |
Direct |
Django - 3.2.18,4.0.10,4.1.7 |
❌ |
| CVE-2023-23969 |
High |
7.5 |
Django-3.2.15-py3-none-any.whl |
Direct |
django - 3.2.17, 4.0.9, 4.1.6 |
❌ |
| CVE-2022-41323 |
High |
7.5 |
Django-3.2.15-py3-none-any.whl |
Direct |
Django - 3.2.16,4.0.8,4.1.2 |
❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2023-31047
Vulnerable Library - Django-3.2.15-py3-none-any.whl
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl
Path to dependency file: /requirements/requirements.txt
Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt
Dependency Hierarchy:
- ❌ Django-3.2.15-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
Publish Date: 2023-05-07
URL: CVE-2023-31047
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://seclists.org/oss-sec/2023/q2/110
Release Date: 2023-05-07
Fix Resolution: Django - 3.2.19,4.1.9,4.2.1
Step up your Open Source Security Game with Mend here
CVE-2023-36053
Vulnerable Library - Django-3.2.15-py3-none-any.whl
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl
Path to dependency file: /requirements/requirements.txt
Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt
Dependency Hierarchy:
- ❌ Django-3.2.15-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
Publish Date: 2023-07-03
URL: CVE-2023-36053
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://seclists.org/oss-sec/2023/q3/2
Release Date: 2023-07-03
Fix Resolution: Django -3.2.20,4.1.10,4.2.3
Step up your Open Source Security Game with Mend here
CVE-2023-24580
Vulnerable Library - Django-3.2.15-py3-none-any.whl
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl
Path to dependency file: /requirements/requirements.txt
Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt
Dependency Hierarchy:
- ❌ Django-3.2.15-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
Publish Date: 2023-02-15
URL: CVE-2023-24580
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://seclists.org/oss-sec/2023/q1/93
Release Date: 2023-02-15
Fix Resolution: Django - 3.2.18,4.0.10,4.1.7
Step up your Open Source Security Game with Mend here
CVE-2023-23969
Vulnerable Library - Django-3.2.15-py3-none-any.whl
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl
Path to dependency file: /requirements/requirements.txt
Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt
Dependency Hierarchy:
- ❌ Django-3.2.15-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
Publish Date: 2023-02-01
URL: CVE-2023-23969
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://www.djangoproject.com/weblog/2023/feb/01/security-releases/
Release Date: 2023-02-01
Fix Resolution: django - 3.2.17, 4.0.9, 4.1.6
Step up your Open Source Security Game with Mend here
CVE-2022-41323
Vulnerable Library - Django-3.2.15-py3-none-any.whl
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl
Path to dependency file: /requirements/requirements.txt
Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt
Dependency Hierarchy:
- ❌ Django-3.2.15-py3-none-any.whl (Vulnerable Library)
Found in base branch: main
Vulnerability Details
In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.
Publish Date: 2022-10-16
URL: CVE-2022-41323
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41323
Release Date: 2022-10-16
Fix Resolution: Django - 3.2.16,4.0.8,4.1.2
Step up your Open Source Security Game with Mend here
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl
Path to dependency file: /requirements/requirements.txt
Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - Django-3.2.15-py3-none-any.whl
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl
Path to dependency file: /requirements/requirements.txt
Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
Publish Date: 2023-05-07
URL: CVE-2023-31047
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://seclists.org/oss-sec/2023/q2/110
Release Date: 2023-05-07
Fix Resolution: Django - 3.2.19,4.1.9,4.2.1
Step up your Open Source Security Game with Mend here
Vulnerable Library - Django-3.2.15-py3-none-any.whl
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl
Path to dependency file: /requirements/requirements.txt
Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
Publish Date: 2023-07-03
URL: CVE-2023-36053
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://seclists.org/oss-sec/2023/q3/2
Release Date: 2023-07-03
Fix Resolution: Django -3.2.20,4.1.10,4.2.3
Step up your Open Source Security Game with Mend here
Vulnerable Library - Django-3.2.15-py3-none-any.whl
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl
Path to dependency file: /requirements/requirements.txt
Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack.
Publish Date: 2023-02-15
URL: CVE-2023-24580
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://seclists.org/oss-sec/2023/q1/93
Release Date: 2023-02-15
Fix Resolution: Django - 3.2.18,4.0.10,4.1.7
Step up your Open Source Security Game with Mend here
Vulnerable Library - Django-3.2.15-py3-none-any.whl
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl
Path to dependency file: /requirements/requirements.txt
Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
Publish Date: 2023-02-01
URL: CVE-2023-23969
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.djangoproject.com/weblog/2023/feb/01/security-releases/
Release Date: 2023-02-01
Fix Resolution: django - 3.2.17, 4.0.9, 4.1.6
Step up your Open Source Security Game with Mend here
Vulnerable Library - Django-3.2.15-py3-none-any.whl
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
Library home page: https://files.pythonhosted.org/packages/db/f9/9ddc8444397ed7e72c52f63b48ecc2849ae1ca4d621776399a81e501ee3c/Django-3.2.15-py3-none-any.whl
Path to dependency file: /requirements/requirements.txt
Path to vulnerable library: /requirements/requirements.txt,/requirements/requirements.txt
Dependency Hierarchy:
Found in base branch: main
Vulnerability Details
In Django 3.2 before 3.2.16, 4.0 before 4.0.8, and 4.1 before 4.1.2, internationalized URLs were subject to a potential denial of service attack via the locale parameter, which is treated as a regular expression.
Publish Date: 2022-10-16
URL: CVE-2022-41323
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41323
Release Date: 2022-10-16
Fix Resolution: Django - 3.2.16,4.0.8,4.1.2
Step up your Open Source Security Game with Mend here