mirror of https://github.com/django/django.git
32 lines
1.2 KiB
Plaintext
32 lines
1.2 KiB
Plaintext
==========================
|
|
Django 4.2.7 release notes
|
|
==========================
|
|
|
|
*November 1, 2023*
|
|
|
|
Django 4.2.7 fixes a security issue with severity "moderate" and several bugs
|
|
in 4.2.6.
|
|
|
|
CVE-2023-46695: Potential denial of service vulnerability in ``UsernameField`` on Windows
|
|
=========================================================================================
|
|
|
|
The :func:`NFKC normalization <python:unicodedata.normalize>` is slow on
|
|
Windows. As a consequence, ``django.contrib.auth.forms.UsernameField`` was
|
|
subject to a potential denial of service attack via certain inputs with a very
|
|
large number of Unicode characters.
|
|
|
|
In order to avoid the vulnerability, invalid values longer than
|
|
``UsernameField.max_length`` are no longer normalized, since they cannot pass
|
|
validation anyway.
|
|
|
|
Bugfixes
|
|
========
|
|
|
|
* Fixed a regression in Django 4.2 that caused a crash of
|
|
``QuerySet.aggregate()`` with aggregates referencing expressions containing
|
|
subqueries (:ticket:`34798`).
|
|
|
|
* Restored, following a regression in Django 4.2, creating
|
|
``varchar/text_pattern_ops`` indexes on ``CharField`` and ``TextField`` with
|
|
deterministic collations on PostgreSQL (:ticket:`34932`).
|