blob: f975e45166ee16365c03677ed1731868811c7f6b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
|
===========================
Django 5.2.11 release notes
===========================
*February 3, 2026*
Django 5.2.11 fixes three security issues with severity "high", two security
issues with severity "moderate", and one security issue with severity "low" in
5.2.10.
CVE-2025-13473: Username enumeration through timing difference in mod_wsgi authentication handler
=================================================================================================
The ``django.contrib.auth.handlers.modwsgi.check_password()`` function for
:doc:`authentication via mod_wsgi</howto/deployment/wsgi/apache-auth>`
allowed remote attackers to enumerate users via a timing attack.
This issue has severity "low" according to the :ref:`Django security policy
<security-disclosure>`.
|
