From d16133568ef9c9b42cb7a08bdf9ff3feec2e5468 Mon Sep 17 00:00:00 2001 From: Mariusz Felisiak Date: Fri, 21 Jan 2022 07:50:03 +0100 Subject: [3.2.x] Fixed CVE-2022-23833 -- Fixed DoS possiblity in file uploads. Thanks Alan Ryan for the report and initial patch. Backport of fc18f36c4ab94399366ca2f2007b3692559a6f23 from main. --- docs/releases/2.2.27.txt | 6 ++++++ docs/releases/3.2.12.txt | 6 ++++++ 2 files changed, 12 insertions(+) (limited to 'docs') diff --git a/docs/releases/2.2.27.txt b/docs/releases/2.2.27.txt index b1712c649c..688a482575 100644 --- a/docs/releases/2.2.27.txt +++ b/docs/releases/2.2.27.txt @@ -15,3 +15,9 @@ posing an XSS attack vector. In order to avoid this vulnerability, ``{% debug %}`` no longer outputs an information when the ``DEBUG`` setting is ``False``, and it ensures all context variables are correctly escaped when the ``DEBUG`` setting is ``True``. + +CVE-2022-23833: Denial-of-service possibility in file uploads +============================================================= + +Passing certain inputs to multipart forms could result in an infinite loop when +parsing files. diff --git a/docs/releases/3.2.12.txt b/docs/releases/3.2.12.txt index 31bc7d2c59..0907050791 100644 --- a/docs/releases/3.2.12.txt +++ b/docs/releases/3.2.12.txt @@ -15,3 +15,9 @@ posing an XSS attack vector. In order to avoid this vulnerability, ``{% debug %}`` no longer outputs an information when the ``DEBUG`` setting is ``False``, and it ensures all context variables are correctly escaped when the ``DEBUG`` setting is ``True``. + +CVE-2022-23833: Denial-of-service possibility in file uploads +============================================================= + +Passing certain inputs to multipart forms could result in an infinite loop when +parsing files. -- cgit v1.3