PT-2023-7674 · Django+2 · Django+2

Mprogrammer

·

Published

2023-11-02

·

Updated

2024-07-30

·

CVE-2023-46695

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Django versions 3.2 before 3.2.23 Django versions 4.1 before 4.1.13 Django versions 4.2 before 4.2.7
Description The issue is related to the NFKC normalization being slow on Windows, which can lead to a potential denial of service (DoS) attack via certain inputs with a very large number of Unicode characters. This affects the django.contrib.auth.forms.UsernameField, making it subject to exploitation. The vulnerability is related to unlimited resource allocation, which can be exploited by a remote attacker to cause a denial of service.
Recommendations For Django versions 3.2 before 3.2.23, update to version 3.2.23 or later to resolve the issue. For Django versions 4.1 before 4.1.13, update to version 4.1.13 or later to resolve the issue. For Django versions 4.2 before 4.2.7, update to version 4.2.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of the UsernameField in the affected versions to minimize the risk of exploitation.

Fix

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

Related Identifiers

ALT-PU-2023-8342
ALT-PU-2023-8343
ALT-PU-2024-3676
ALT-PU-2024-8036
BDU:2023-08741
BIT-DJANGO-2023-46695
CVE-2023-46695
GHSA-QMF9-6JQF-J8FQ
OESA-2023-1846
PYSEC-2023-222

Affected Products

Alt Linux
Django
Red Os