Medium WID-SEC-2023-2791 1 CVE

Django: Schwachstelle ermöglicht Denial of Service

Published Oct 31, 2023 · Updated Oct 31, 2023 · de-DE

Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Django ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Django ist ein in Python geschriebenes serverseitiges Web-Framework, das einem Model-View-Presenter-Schema folgt.

Vulnerabilities 1

High 7.5

CVE-2023-46695 EPSS 53%

Django potential denial of service vulnerability in UsernameField on Windows

An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via cer…

django PyPI

Nov 2, 2023

Revision history

2023-10-31 #1
Initiale Fassung

References

https://www.djangoproject.com/weblog/2023/nov/01/security-releases/ vom 2023-10-31
https://www.djangoproject.com/weblog/2023/nov/01/security-releases/