FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

py-wagtail -- DoS vulnerability

Affected packages
4.2.0 <= py310-wagtail < 4.2.2
4.2.0 <= py311-wagtail < 4.2.2
4.2.0 <= py37-wagtail < 4.2.2
4.2.0 <= py38-wagtail < 4.2.2
4.2.0 <= py39-wagtail < 4.2.2

Details

VuXML ID 2def7c4b-736f-4754-9f03-236fcb586d91
Discovery 2023-04-03
Entry 2023-08-31

A memory exhaustion bug exists in Wagtail's handling of uploaded images and documents.

For both images and documents, files are loaded into memory during upload for additional processing.

A user with access to upload images or documents through the Wagtail admin interface could upload a file so large that it results in a crash or denial of service.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.

It can only be exploited by admin users with permission to upload images or documents.

Image uploads are restricted to 10MB by default, however this validation only happens on the frontend and on the backend after the vulnerable code.

References

CVE Name CVE-2023-28837
URL https://osv.dev/vulnerability/GHSA-33pv-vcgh-jfg9