0
0
mirror of https://github.com/django/django.git synced 2024-11-22 11:57:34 +01:00
django/docs/releases/4.1.6.txt
Nick Pope 8c660fb592 Fixed CVE-2023-23969 -- Prevented DoS with pathological values for Accept-Language.
The parsed values of Accept-Language headers are cached in order to
avoid repetitive parsing. This leads to a potential denial-of-service
vector via excessive memory usage if the raw value of Accept-Language
headers is very large.

Accept-Language headers are now limited to a maximum length in order
to avoid this issue.
2023-02-01 09:44:04 +01:00

25 lines
812 B
Plaintext

==========================
Django 4.1.6 release notes
==========================
*February 1, 2023*
Django 4.1.6 fixes a security issue with severity "moderate" and a bug in
4.1.5.
CVE-2023-23969: Potential denial-of-service via ``Accept-Language`` headers
===========================================================================
The parsed values of ``Accept-Language`` headers are cached in order to avoid
repetitive parsing. This leads to a potential denial-of-service vector via
excessive memory usage if large header values are sent.
In order to avoid this vulnerability, the ``Accept-Language`` header is now
parsed up to a maximum length.
Bugfixes
========
* Fixed a bug in Django 4.1 that caused a crash of model validation on
``UniqueConstraint`` with ordered expressions (:ticket:`34291`).