diff options
| author | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2023-10-17 11:48:32 +0200 |
|---|---|---|
| committer | Mariusz Felisiak <felisiak.mariusz@gmail.com> | 2023-11-01 06:10:30 +0100 |
| commit | 05ba4130ee878c4f520b5d34bb11eaad794623be (patch) | |
| tree | 1d11111ee476d411c8fc62bd6da6e9376d2f1d4e /docs/releases/4.2.7.txt | |
| parent | 40b3975e7d3e1464a733c69171ad7d38f8814280 (diff) | |
Fixed CVE-2023-46695 -- Fixed potential DoS in UsernameField on Windows.
Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report.
Diffstat (limited to 'docs/releases/4.2.7.txt')
| -rw-r--r-- | docs/releases/4.2.7.txt | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/docs/releases/4.2.7.txt b/docs/releases/4.2.7.txt index 0b1228c9f6..13d902475b 100644 --- a/docs/releases/4.2.7.txt +++ b/docs/releases/4.2.7.txt @@ -7,6 +7,18 @@ Django 4.2.7 release notes Django 4.2.7 fixes a security issue with severity "moderate" and several bugs in 4.2.6. +CVE-2023-46695: Potential denial of service vulnerability in ``UsernameField`` on Windows +========================================================================================= + +The :func:`NFKC normalization <python:unicodedata.normalize>` is slow on +Windows. As a consequence, ``django.contrib.auth.forms.UsernameField`` was +subject to a potential denial of service attack via certain inputs with a very +large number of Unicode characters. + +In order to avoid the vulnerability, invalid values longer than +``UsernameField.max_length`` are no longer normalized, since they cannot pass +validation anyway. + Bugfixes ======== |