CVE-2023-46695 - Vulnerability Details - OpenCVE

An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.03582.

Key SSVC decision points have not yet been added.

Vendors	Products
Djangoproject Subscribe	Django Subscribe

Configuration 1 [-]

OR	cpe:2.3:a:djangoproject:django::::::::
	cpe:2.3:a:djangoproject:django::::::::
	cpe:2.3:a:djangoproject:django::::::::

No data.

No data.

Advisories

Source	ID	Title
Github GHSA	GHSA-qmf9-6jqf-j8fq	Django potential denial of service vulnerability in UsernameField on Windows

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://docs.djangoproject.com/en/4.2/releases/security/
https://groups.google.com/forum/#%21forum/django-announce
https://nvd.nist.gov/vuln/detail/CVE-2023-46695
https://security.netapp.com/advisory/ntap-20231214-0001/
https://www.cve.org/CVERecord?id=CVE-2023-46695
https://www.djangoproject.com/weblog/2023/nov/01/security-releases/

History

No history.

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-11-02T00:00:00

Updated: 2024-08-02T20:53:20.867Z

Reserved: 2023-10-25T00:00:00

Link: CVE-2023-46695

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-11-02T06:15:08.000

Modified: 2024-11-21T08:29:05.987

Link: CVE-2023-46695

Redhat

Severity : Moderate

Publid Date: 2023-11-01T07:00:00Z

Links: CVE-2023-46695 - Bugzilla

OpenCVE Enrichment

No data.

Weaknesses

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "matchCriteriaId": "9909EFAF-C1C8-49FA-860F-C2430EC5304D", "versionEndExcluding": "3.2.23", "versionStartIncluding": "3.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "matchCriteriaId": "0ED58B2B-B564-4EE4-AE69-1E206AE34B65", "versionEndExcluding": "4.1.13", "versionStartIncluding": "4.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "matchCriteriaId": "A76F97FB-F751-4E8A-B4CD-43ECEA9528CE", "versionEndExcluding": "4.2.7", "versionStartIncluding": "4.2.", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Django 3.2 anterior a 3.2.23, 4.1 anterior a 4.1.13 y 4.2 anterior a 4.2.7. La normalizaci\u00f3n de NFKC es lenta en Windows. Como consecuencia, django.contrib.auth.forms.UsernameField est\u00e1 sujeto a un potencial ataque DoS (denegaci\u00f3n de servicio) a trav\u00e9s de ciertas entradas con una gran cantidad de caracteres Unicode."}], "id": "CVE-2023-46695", "lastModified": "2024-11-21T08:29:05.987", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-11-02T06:15:08.000", "references": [{"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://docs.djangoproject.com/en/4.2/releases/security/"}, {"source": "cve@mitre.org", "tags": ["Permissions Required"], "url": "https://groups.google.com/forum/#%21forum/django-announce"}, {"source": "cve@mitre.org", "url": "https://security.netapp.com/advisory/ntap-20231214-0001/"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.djangoproject.com/weblog/2023/nov/01/security-releases/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://docs.djangoproject.com/en/4.2/releases/security/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://groups.google.com/forum/#%21forum/django-announce"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20231214-0001/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.djangoproject.com/weblog/2023/nov/01/security-releases/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "python-django: Potential denial of service vulnerability in UsernameField on Windows", "id": "2247097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2247097"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-20", "details": ["An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.", "A vulnerability was discovered in the Django package, where NFKC normalization could take a significant time. This flaw allows a remote, unauthenticated attacker to cause a denial of service by submitting inputs with a large number of Unicode characters."], "name": "CVE-2023-46695", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:openstack:16.1", "fix_state": "Not affected", "package_name": "python-django20", "product_name": "Red Hat OpenStack Platform 16.1"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "python-django20", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:storage:3", "fix_state": "Affected", "package_name": "python-django", "product_name": "Red Hat Storage 3"}, {"cpe": "cpe:/a:redhat:rhui:4::el8", "fix_state": "Not affected", "package_name": "python-django", "product_name": "Red Hat Update Infrastructure 4 for Cloud Providers"}], "public_date": "2023-11-01T07:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-46695\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-46695"], "statement": "Only Windows environments are impacted by this vulnerability.", "threat_severity": "Moderate"}