Safety vulnerability ID: 52945
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Django 3.2.17, 4.0.9 and 4.1.6 includes a fix for CVE-2023-23969: In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large.
https://www.djangoproject.com/weblog/2023/feb/01/security-releases
Latest version: 5.0.4
A high-level Python web framework that encourages rapid development and clean, pragmatic design.
In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large. See CVE-2023-23969.
CONFIRM:https://www.djangoproject.com/weblog/2023/feb/01/security-releases/: https://www.djangoproject.com/weblog/2023/feb/01/security-releases/
MISC:https://docs.djangoproject.com/en/4.1/releases/security/: https://docs.djangoproject.com/en/4.1/releases/security/
MISC:https://groups.google.com/forum/#!forum/django-announce: https://groups.google.com/forum/#%21forum/django-announce
MLIST:[debian-lts-announce] 20230201 [SECURITY] [DLA 3306-1] python-django security update: https://lists.debian.org/debian-lts-announce/2023/02/msg00000.html
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application