Description
An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | django | >= 3.2a1, < 3.2.23 | 3.2.23 | GHSA-qmf9-6jqf-j8fq |
| PyPI | django | >= 4.1a1, < 4.1.13 | 4.1.13 | GHSA-qmf9-6jqf-j8fq |
| PyPI | django | >= 4.2a1, < 4.2.7 | 4.2.7 | GHSA-qmf9-6jqf-j8fq |
| PyPI | django | >= 3.2, < 3.2.23 · >= 4.1, < 4.1.13 · >= 4.2, < 4.2.7 | 3.2.23, 4.1.13, 4.2.7 | PYSEC-2023-222 |
Advisories 1
- WID-SEC-2023-2791 Django: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Oct 31, 2023