From 8a7b22d4a623bcd95190d2f5a958472fb41e576d Mon Sep 17 00:00:00 2001 From: Nick Pope Date: Wed, 25 Jan 2023 12:21:48 +0100 Subject: [4.2.x] Fixed CVE-2023-23969 -- Prevented DoS with pathological values for Accept-Language. The parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large. Accept-Language headers are now limited to a maximum length in order to avoid this issue. --- docs/releases/3.2.17.txt | 10 +++++++++- docs/releases/4.0.9.txt | 10 +++++++++- docs/releases/4.1.6.txt | 14 ++++++++++++-- 3 files changed, 30 insertions(+), 4 deletions(-) (limited to 'docs') diff --git a/docs/releases/3.2.17.txt b/docs/releases/3.2.17.txt index 9eba24d72f..fcc097c5cc 100644 --- a/docs/releases/3.2.17.txt +++ b/docs/releases/3.2.17.txt @@ -6,4 +6,12 @@ Django 3.2.17 release notes Django 3.2.17 fixes a security issue with severity "moderate" in 3.2.16. -... +CVE-2023-23969: Potential denial-of-service via ``Accept-Language`` headers +=========================================================================== + +The parsed values of ``Accept-Language`` headers are cached in order to avoid +repetitive parsing. This leads to a potential denial-of-service vector via +excessive memory usage if large header values are sent. + +In order to avoid this vulnerability, the ``Accept-Language`` header is now +parsed up to a maximum length. diff --git a/docs/releases/4.0.9.txt b/docs/releases/4.0.9.txt index f05b043c34..d13f3a2cf6 100644 --- a/docs/releases/4.0.9.txt +++ b/docs/releases/4.0.9.txt @@ -6,4 +6,12 @@ Django 4.0.9 release notes Django 4.0.9 fixes a security issue with severity "moderate" in 4.0.8. -... +CVE-2023-23969: Potential denial-of-service via ``Accept-Language`` headers +=========================================================================== + +The parsed values of ``Accept-Language`` headers are cached in order to avoid +repetitive parsing. This leads to a potential denial-of-service vector via +excessive memory usage if large header values are sent. + +In order to avoid this vulnerability, the ``Accept-Language`` header is now +parsed up to a maximum length. diff --git a/docs/releases/4.1.6.txt b/docs/releases/4.1.6.txt index e97c25aea0..04b75683f2 100644 --- a/docs/releases/4.1.6.txt +++ b/docs/releases/4.1.6.txt @@ -4,8 +4,18 @@ Django 4.1.6 release notes *February 1, 2023* -Django 4.1.6 fixes a security issue with severity "moderate" and several bugs -in 4.1.5. +Django 4.1.6 fixes a security issue with severity "moderate" and a bug in +4.1.5. + +CVE-2023-23969: Potential denial-of-service via ``Accept-Language`` headers +=========================================================================== + +The parsed values of ``Accept-Language`` headers are cached in order to avoid +repetitive parsing. This leads to a potential denial-of-service vector via +excessive memory usage if large header values are sent. + +In order to avoid this vulnerability, the ``Accept-Language`` header is now +parsed up to a maximum length. Bugfixes ======== -- cgit v1.3