CVE-2023-46695
highPriorität · beachten · 47EPSS 0.498 · 99. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (22)
Betroffene Produkte und Versionsbereiche.
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2023-2791Django: Schwachstelle ermöglicht Denial of ServiceDeutsch2023-10-31csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Django ausnutzen, um einen Denial of Service Angriff durchzuführen.
- GHSA-qmf9-6jqf-j8fqDjango potential denial of service vulnerability in UsernameField on Windows2023-11-02ghsa · osvUS
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
- BIT-django-2023-466952024-03-06vendor · osvUS
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
- PYSEC-2023-2222023-11-02vendor · osvUS
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
auch bekannt als (8)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (13)
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/cve-2023-46695cnnvd
- https://cxsecurity.com/cveshow/CVE-2023-46695/cnnvd
- https://docs.djangoproject.com/en/4.2/releases/security/cnnvd
- https://groups.google.com/forum/#!forum/django-announcecnnvd
- https://www.djangoproject.com/weblog/2023/nov/01/security-releases/cnnvd
- https://docs.djangoproject.com/en/4.2/releases/security/enisa_euvd
- https://groups.google.com/forum/#%21forum/django-announceenisa_euvd
- https://security.netapp.com/advisory/ntap-20231214-0001/enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan