CVE-2023-46695

Advisory

Django 4.2.7, 4.1.13 and 3.2.23 include a fix for CVE-2023-46695: Potential denial of service vulnerability in UsernameField on Windows.
https://www.djangoproject.com/weblog/2023/nov/01/security-releases

Affected package

Affected versions

Fixed versions

Vulnerability changelog

===========================

*November 1, 2023*

Django 3.2.23 fixes a security issue with severity "moderate" in 3.2.22.

CVE-2023-46695: Potential denial of service vulnerability in ``UsernameField`` on Windows
=========================================================================================

The :func:`NFKC normalization <python:unicodedata.normalize>` is slow on
Windows. As a consequence, ``django.contrib.auth.forms.UsernameField`` was
subject to a potential denial of service attack via certain inputs with a very
large number of Unicode characters.

In order to avoid the vulnerability, invalid values longer than
``UsernameField.max_length`` are no longer normalized, since they cannot pass
validation anyway.


===========================

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46695
• https://docs.djangoproject.com/en/4.2/releases/security/
• https://www.djangoproject.com/weblog/2023/nov/01/security-releases/
• https://groups.google.com/forum/#%21forum/django-announce
• https://security.netapp.com/advisory/ntap-20231214-0001/