mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 14:16:09 +00:00
Code Issues 32 Releases Wiki Activity

[4.2.x] Fixed CVE-2023-23969 -- Prevented DoS with pathological values for Accept-Language.

Browse Source 
The parsed values of Accept-Language headers are cached in order to
avoid repetitive parsing. This leads to a potential denial-of-service
vector via excessive memory usage if the raw value of Accept-Language
headers is very large.

Accept-Language headers are now limited to a maximum length in order
to avoid this issue.
This commit is contained in:
Nick Pope
2023-01-25 12:21:48 +01:00
committed by Mariusz Felisiak
parent 5e0be0873c
commit 8a7b22d4a6
5 changed files with 72 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/releases/3.2.17.txt
View File

@@ -6,4 +6,12 @@ Django 3.2.17 release notes
Django 3.2.17 fixes a security issue with severity "moderate" in 3.2.16.
...
CVE-2023-23969: Potential denial-of-service via ``Accept-Language`` headers
===========================================================================
The parsed values of ``Accept-Language`` headers are cached in order to avoid
repetitive parsing. This leads to a potential denial-of-service vector via
excessive memory usage if large header values are sent.
In order to avoid this vulnerability, the ``Accept-Language`` header is now
parsed up to a maximum length.

10
docs/releases/4.0.9.txt
View File

@@ -6,4 +6,12 @@ Django 4.0.9 release notes
Django 4.0.9 fixes a security issue with severity "moderate" in 4.0.8.
...
CVE-2023-23969: Potential denial-of-service via ``Accept-Language`` headers
===========================================================================
The parsed values of ``Accept-Language`` headers are cached in order to avoid
repetitive parsing. This leads to a potential denial-of-service vector via
excessive memory usage if large header values are sent.
In order to avoid this vulnerability, the ``Accept-Language`` header is now
parsed up to a maximum length.

14
docs/releases/4.1.6.txt
View File

@@ -4,8 +4,18 @@ Django 4.1.6 release notes
*February 1, 2023*
Django 4.1.6 fixes a security issue with severity "moderate" and several bugs
in 4.1.5.
Django 4.1.6 fixes a security issue with severity "moderate" and a bug in
4.1.5.
CVE-2023-23969: Potential denial-of-service via ``Accept-Language`` headers
===========================================================================
The parsed values of ``Accept-Language`` headers are cached in order to avoid
repetitive parsing. This leads to a potential denial-of-service vector via
excessive memory usage if large header values are sent.
In order to avoid this vulnerability, the ``Accept-Language`` header is now
parsed up to a maximum length.
Bugfixes
========