Django potential denial of service vulnerability in UsernameField on Windows
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-46695US | high7.5 | — | ||
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms… | ||||
02
references
External citations — patches, advisories, analysis.
- https://docs.djangoproject.com/en/4.2/releases/securityWEB
- https://github.com/django/djangoPACKAGE
- https://github.com/django/django/commit/048a9ebb6ea468426cb4e57c71572cbbd975517fWEB
- https://github.com/django/django/commit/4965bfdde2e5a5c883685019e57d123a3368a75eWEB
- https://github.com/django/django/commit/f9a7fb8466a7ba4857eaf930099b5258f3eafb2bWEB
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2023-222.yamlWEB
- https://groups.google.com/forum/#!forum/django-announceWEB
- https://groups.google.com/forum/#%21forum/django-announceWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan