An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-46695US | high7.5 | — | ||
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://docs.djangoproject.com/en/4.2/releases/security/FIX
- https://groups.google.com/forum/#%21forum/django-announceWEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-46695WEB
- https://security.netapp.com/advisory/ntap-20231214-0001/WEB
- https://www.djangoproject.com/weblog/2023/nov/01/security-releases/ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan