mirror of
https://github.com/django/django.git
synced 2025-04-20 07:14:35 +00:00
8c6871b097
Thank you sw0rd1ight for the report. Backport of 39e2297210d9d2938c75fc911d45f0e863dc4821 from main.
18 lines
793 B
Plaintext
18 lines
793 B
Plaintext
===========================
|
|
Django 5.0.14 release notes
|
|
===========================
|
|
|
|
*April 2, 2025*
|
|
|
|
Django 5.0.14 fixes a security issue with severity "moderate" in 5.0.13.
|
|
|
|
CVE-2025-27556: Potential denial-of-service vulnerability in ``LoginView``, ``LogoutView``, and ``set_language()`` on Windows
|
|
=============================================================================================================================
|
|
|
|
Python's :func:`NFKC normalization <python:unicodedata.normalize>` is slow on
|
|
Windows. As a consequence, :class:`~django.contrib.auth.views.LoginView`,
|
|
:class:`~django.contrib.auth.views.LogoutView`, and
|
|
:func:`~django.views.i18n.set_language` were subject to a potential
|
|
denial-of-service attack via certain inputs with a very large number of Unicode
|
|
characters.
|