1
0
mirror of https://github.com/django/django.git synced 2024-12-23 01:25:58 +00:00
django/docs/releases/2.2.26.txt
Florian Apolloner 968a3d01fa Fixed CVE-2021-45115 -- Prevented DoS vector in UserAttributeSimilarityValidator.
Thanks Chris Bailey for the report.

Co-authored-by: Adam Johnson <me@adamj.eu>
2022-01-04 10:02:05 +01:00

23 lines
916 B
Plaintext

===========================
Django 2.2.26 release notes
===========================
*January 4, 2022*
Django 2.2.26 fixes one security issue with severity "medium" and two security
issues with severity "low" in 2.2.25.
CVE-2021-45115: Denial-of-service possibility in ``UserAttributeSimilarityValidator``
=====================================================================================
:class:`.UserAttributeSimilarityValidator` incurred significant overhead
evaluating submitted password that were artificially large in relative to the
comparison values. On the assumption that access to user registration was
unrestricted this provided a potential vector for a denial-of-service attack.
In order to mitigate this issue, relatively long values are now ignored by
``UserAttributeSimilarityValidator``.
This issue has severity "medium" according to the :ref:`Django security policy
<security-disclosure>`.