From 048a9ebb6ea468426cb4e57c71572cbbd975517f Mon Sep 17 00:00:00 2001 From: Mariusz Felisiak Date: Tue, 17 Oct 2023 11:48:32 +0200 Subject: [4.2.x] Fixed CVE-2023-46695 -- Fixed potential DoS in UsernameField on Windows. Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report. --- docs/releases/3.2.23.txt | 12 +++++++++++- docs/releases/4.1.13.txt | 12 +++++++++++- docs/releases/4.2.7.txt | 12 ++++++++++++ 3 files changed, 34 insertions(+), 2 deletions(-) (limited to 'docs') diff --git a/docs/releases/3.2.23.txt b/docs/releases/3.2.23.txt index 0d71a0aa71..ba23d11a71 100644 --- a/docs/releases/3.2.23.txt +++ b/docs/releases/3.2.23.txt @@ -6,4 +6,14 @@ Django 3.2.23 release notes Django 3.2.23 fixes a security issue with severity "moderate" in 3.2.22. -... +CVE-2023-46695: Potential denial of service vulnerability in ``UsernameField`` on Windows +========================================================================================= + +The :func:`NFKC normalization ` is slow on +Windows. As a consequence, ``django.contrib.auth.forms.UsernameField`` was +subject to a potential denial of service attack via certain inputs with a very +large number of Unicode characters. + +In order to avoid the vulnerability, invalid values longer than +``UsernameField.max_length`` are no longer normalized, since they cannot pass +validation anyway. diff --git a/docs/releases/4.1.13.txt b/docs/releases/4.1.13.txt index c2fb5afcd3..01ad5dda62 100644 --- a/docs/releases/4.1.13.txt +++ b/docs/releases/4.1.13.txt @@ -6,4 +6,14 @@ Django 4.1.13 release notes Django 4.1.13 fixes a security issue with severity "moderate" in 4.1.12. -... +CVE-2023-46695: Potential denial of service vulnerability in ``UsernameField`` on Windows +========================================================================================= + +The :func:`NFKC normalization ` is slow on +Windows. As a consequence, ``django.contrib.auth.forms.UsernameField`` was +subject to a potential denial of service attack via certain inputs with a very +large number of Unicode characters. + +In order to avoid the vulnerability, invalid values longer than +``UsernameField.max_length`` are no longer normalized, since they cannot pass +validation anyway. diff --git a/docs/releases/4.2.7.txt b/docs/releases/4.2.7.txt index 0b1228c9f6..13d902475b 100644 --- a/docs/releases/4.2.7.txt +++ b/docs/releases/4.2.7.txt @@ -7,6 +7,18 @@ Django 4.2.7 release notes Django 4.2.7 fixes a security issue with severity "moderate" and several bugs in 4.2.6. +CVE-2023-46695: Potential denial of service vulnerability in ``UsernameField`` on Windows +========================================================================================= + +The :func:`NFKC normalization ` is slow on +Windows. As a consequence, ``django.contrib.auth.forms.UsernameField`` was +subject to a potential denial of service attack via certain inputs with a very +large number of Unicode characters. + +In order to avoid the vulnerability, invalid values longer than +``UsernameField.max_length`` are no longer normalized, since they cannot pass +validation anyway. + Bugfixes ======== -- cgit v1.3