Bug 2247097 (CVE-2023-46695)

Summary: CVE-2023-46695 python-django: Potential denial of service vulnerability in UsernameField on Windows
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: adudiak, apevec, bbuckingham, bcourt, caswilli, eglynn, ehelms, epacific, gtanzill, jcammara, jhardy, jjoyce, jmitchel, jneedle, jobarker, jschluet, jsherril, jtanner, kaycoth, kshier, lhh, luizcosta, lzap, mabashia, mburns, mgarciac, mhulan, mminar, nmoumoul, nweather, orabin, pcreech, pgrist, rbiba, rbobbitt, rchan, rhos-maint, security-response-team, simaishi, smcdonal, sskracic, stcannon, teagle, tfister, yguenane, zsadeh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was discovered in the Django package, where NFKC normalization could take a significant time. This flaw allows a remote, unauthenticated attacker to cause a denial of service by submitting inputs with a large number of Unicode characters.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2249284, 2249279, 2249280, 2249281, 2249282, 2249283, 2249285, 2249286, 2249287, 2249288    
Bug Blocks: 2247098    

Description Guilherme de Almeida Suckevicz 2023-10-30 16:35:45 UTC 
The NFKC normalization is slow on Windows. As a consequence, ``django.contrib.auth.forms.UsernameField`` was subject to a potential denial of service attack via certain inputs with a very large number of Unicode characters.

In order to avoid the vulnerability, invalid values longer than ``UsernameField.max_length`` are no longer normalized, since they cannot pass validation anyway.
Comment 3 Nick Tait 2023-11-11 22:06:48 UTC 
Created python-django tracking bugs for this issue:

Affects: openstack-rdo [bug 2249282]
Comment 6 Nick Tait 2023-11-11 22:08:51 UTC 
Created python-django tracking bugs for this issue:

Affects: epel-all [bug 2249286]
Affects: fedora-all [bug 2249288]


Created python-django16 tracking bugs for this issue:

Affects: epel-all [bug 2249284]


Created python-django3 tracking bugs for this issue:

Affects: epel-all [bug 2249285]
Affects: fedora-all [bug 2249287]