CVE-2023-32321: Ckan remote code execution and private information access via crafted resource ids

Specific vulnerabilities:

• Arbitrary file write in resource_create and package_update actions, using the ResourceUploader object. Also reachable via package_create, package_revise, and package_patch via calls to package_update.
• Remote code execution via unsafe pickle loading, via Beaker’s session store when configured to use the file session store backend.
• Potential DOS due to lack of a length check on the resource id.
• Information disclosure: A user with permission to create a resource can access any other resource on the system if they know the id, even if they don’t have access to it.
• Resource overwrite: A user with permission to create a resource can overwrite any resource if they know the id, even if they don’t have access to it.