Memory Exhaustion Vulnerability in Python-Django: CVE-2023-23969
Summary
UBUNTU-CVE-2023-23969: In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and is known for its robustness and scalability. However, certain versions of Python-Django are vulnerable to a memory exhaustion issue due to improper handling of Accept-Language headers, which can lead to denial-of-service attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2023-23969, affects Django versions 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6. It arises from the caching of parsed Accept-Language headers, which can lead to excessive memory usage if the raw header values are excessively large. This can result in a denial-of-service condition, making the application unresponsive and potentially crashing the server.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing input validation on the Accept-Language headers to limit their size and prevent excessively large values from being processed. This can help mitigate the risk until the package is updated.
Conclusion
CVE-2023-23969 presents a significant risk to applications using vulnerable versions of Python-Django due to potential denial-of-service attacks. It is crucial to update to the latest patched versions to mitigate this risk and ensure the stability of your applications.
See every vulnerability recorded for python-django →
FAQ
CVE-2023-23969 is a vulnerability in Python-Django that allows for potential denial-of-service attacks due to excessive memory usage from large Accept-Language headers.
The affected versions include Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to install any software.
The CVSS score for CVE-2023-23969 is 7.5, indicating a high severity level.
Yes, you can implement input validation on Accept-Language headers to limit their size as a temporary workaround until the package is updated.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
