[Bug 2196197] New: CVE-2023-31047 python-django3: python-django: Potential bypass of validation when uploading multiple files using one form field [fedora-all]
4:28 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
Bug ID: 2196197
Summary: CVE-2023-31047 python-django3: python-django:
Potential bypass of validation when uploading multiple
files using one form field [fedora-all]
Product: Fedora
Version: 38
Status: NEW
Component: python-django3
Keywords: Security, SecurityTracking
Severity: low
Priority: low
Assignee: michel(a)michel-slm.name
Reporter: ybuenos(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: epel-packagers-sig(a)lists.fedoraproject.org,
michel(a)michel-slm.name
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
http://bugzilla.redhat.com/show_bug.cgi?id=2192565
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
4:29 a.m.
New subject: [Bug 2196197] CVE-2023-31047 python-django3: python-django: Potential bypass of validation when uploading multiple files using one form field [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
--- Comment #1 from ybuenos(a)redhat.com ---
Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug. This will ensure that all associated bugs get updated
when new packages are pushed to stable.
=====
# bugfix, security, enhancement, newpackage (required)
type=security
# low, medium, high, urgent (required)
severity=low
# testing, stable
request=testing
# Bug numbers: 1234,9876
bugs=2192565,2196197
# Description of your update
notes=Security fix for [PUT CVEs HERE]
# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3
# Automatically close bugs when this marked as stable
close_bugs=True
# Suggest that users restart after update
suggest_reboot=False
======
Additionally, you may opt to use the bodhi web interface to submit updates:
https://bodhi.fedoraproject.org/updates/new
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
4:29 a.m.
New subject: [Bug 2196197] CVE-2023-31047 python-django3: python-django: Potential bypass of validation when uploading multiple files using one form field [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
ybuenos(a)redhat.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Blocks| |2192565 (CVE-2023-31047)
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2192565
[Bug 2192565] CVE-2023-31047 python-django: Potential bypass of validation when
uploading multiple files using one form field
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
6:08 p.m.
New subject: [Bug 2196197] CVE-2023-31047 python-django3: python-django: Potential bypass of validation when uploading multiple files using one form field [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |MODIFIED
--- Comment #2 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-8f9d949dbc has been submitted as an update to Fedora 37.
https://bodhi.fedoraproject.org/updates/FEDORA-2023-8f9d949dbc
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
6:08 p.m.
New subject: [Bug 2196197] CVE-2023-31047 python-django3: python-django: Potential bypass of validation when uploading multiple files using one form field [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
--- Comment #3 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-0d20d09f2d has been submitted as an update to Fedora 38.
https://bodhi.fedoraproject.org/updates/FEDORA-2023-0d20d09f2d
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
9 p.m.
New subject: [Bug 2196197] CVE-2023-31047 python-django3: python-django: Potential bypass of validation when uploading multiple files using one form field [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|MODIFIED |ON_QA
--- Comment #4 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-0d20d09f2d has been pushed to the Fedora 38 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh
--advisory=FEDORA-2023-0d20d09f2d`
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2023-0d20d09f2d
See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information
on how to test updates.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
10:47 p.m.
New subject: [Bug 2196197] CVE-2023-31047 python-django3: python-django: Potential bypass of validation when uploading multiple files using one form field [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
--- Comment #5 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-8f9d949dbc has been pushed to the Fedora 37 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh
--advisory=FEDORA-2023-8f9d949dbc`
You can provide feedback for this update here:
https://bodhi.fedoraproject.org/updates/FEDORA-2023-8f9d949dbc
See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information
on how to test updates.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
8:57 p.m.
New subject: [Bug 2196197] CVE-2023-31047 python-django3: python-django: Potential bypass of validation when uploading multiple files using one form field [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|ON_QA |CLOSED
Fixed In Version| |python-django3-3.2.19-1.fc3
| |8
Resolution|--- |ERRATA
Last Closed| |2023-05-11 01:57:00
--- Comment #6 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-0d20d09f2d has been pushed to the Fedora 38 stable repository.
If problem still persists, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
8:28 p.m.
New subject: [Bug 2196197] CVE-2023-31047 python-django3: python-django: Potential bypass of validation when uploading multiple files using one form field [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
Fedora Update System <updates(a)fedoraproject.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Fixed In Version|python-django3-3.2.19-1.fc3 |python-django3-3.2.19-1.fc3
|8 |8
| |python-django3-3.2.19-1.fc3
| |7
--- Comment #7 from Fedora Update System <updates(a)fedoraproject.org> ---
FEDORA-2023-8f9d949dbc has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2196197
403
days inactive
411
days old
epel-packagers-sig@lists.fedoraproject.org
8 comments
1 participants
participants (1)
-
bugzilla＠redhat.com