DemoBook a demo

Vulnerability advisory

CVE-2023-46695

Published Updated OSV record ↗

Also known as BIT-django-2023-46695GHSA-qmf9-6jqf-j8fqPYSEC-2023-222

Severity

Severity not reported.

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/django/django ↗
3591e1c1acbd7c13174275367c3fdf012cb0413b to before 60e648a7ae033a9c2d1ab23a58402f57a1754df160e648a7ae033a9c2d1ab23a58402f57a1754df1
9fee86e44dd83dc968ec443adcde191b3eba1286 to before 42591a8aeb48f3cdf7da9fd0631017dd5410525a42591a8aeb48f3cdf7da9fd0631017dd5410525a
97aa3b7f08f51669e118f3af5ca91026e39664c3 to before d254a54e7f65e83d8971bd817031bc6af32a7a46d254a54e7f65e83d8971bd817031bc6af32a7a46

Description

An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.forms.UsernameField is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.