SB2023080401 - Debian update for python-django

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2023-23969)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the Accept-Language headers. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

2) Resource exhaustion (CVE-ID: CVE-2023-24580)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can certain inputs to multipart forms, trigger memory exhaustion and perform a denial of service (DoS) attack.

3) Arbitrary file upload (CVE-ID: CVE-2023-31047)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to the application does not perform validation of files when using one form field for uploading multiple files. A remote attacker can upload a malicious file and execute it on the server.

4) Inefficient regular expression complexity (CVE-ID: CVE-2023-36053)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions within EmailValidator and URLValidator. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Remediation

Install update from vendor's website.

References

• https://www.debian.org/security/2023/dsa-5465