mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 06:06:09 +00:00
Code Issues 32 Releases Wiki Activity

[4.2.x] Fixed CVE-2023-46695 -- Fixed potential DoS in UsernameField on Windows.

Browse Source 
Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report.
This commit is contained in:
Mariusz Felisiak
2023-10-17 11:48:32 +02:00
parent 3fae5d92da
commit 048a9ebb6e
5 changed files with 50 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
docs/releases/3.2.23.txt
View File

@@ -6,4 +6,14 @@ Django 3.2.23 release notes
Django 3.2.23 fixes a security issue with severity "moderate" in 3.2.22.
...
CVE-2023-46695: Potential denial of service vulnerability in ``UsernameField`` on Windows
=========================================================================================
The :func:`NFKC normalization <python:unicodedata.normalize>` is slow on
Windows. As a consequence, ``django.contrib.auth.forms.UsernameField`` was
subject to a potential denial of service attack via certain inputs with a very
large number of Unicode characters.
In order to avoid the vulnerability, invalid values longer than
``UsernameField.max_length`` are no longer normalized, since they cannot pass
validation anyway.

12
docs/releases/4.1.13.txt
View File

@@ -6,4 +6,14 @@ Django 4.1.13 release notes
Django 4.1.13 fixes a security issue with severity "moderate" in 4.1.12.
...
CVE-2023-46695: Potential denial of service vulnerability in ``UsernameField`` on Windows
=========================================================================================
The :func:`NFKC normalization <python:unicodedata.normalize>` is slow on
Windows. As a consequence, ``django.contrib.auth.forms.UsernameField`` was
subject to a potential denial of service attack via certain inputs with a very
large number of Unicode characters.
In order to avoid the vulnerability, invalid values longer than
``UsernameField.max_length`` are no longer normalized, since they cannot pass
validation anyway.

12
docs/releases/4.2.7.txt
View File

@@ -7,6 +7,18 @@ Django 4.2.7 release notes
Django 4.2.7 fixes a security issue with severity "moderate" and several bugs
in 4.2.6.
CVE-2023-46695: Potential denial of service vulnerability in ``UsernameField`` on Windows
=========================================================================================
The :func:`NFKC normalization <python:unicodedata.normalize>` is slow on
Windows. As a consequence, ``django.contrib.auth.forms.UsernameField`` was
subject to a potential denial of service attack via certain inputs with a very
large number of Unicode characters.
In order to avoid the vulnerability, invalid values longer than
``UsernameField.max_length`` are no longer normalized, since they cannot pass
validation anyway.
Bugfixes
========