—

PYSEC-2023-225

Quick fix

PYSEC-2023-225 — django: upgrade to the fixed version with the command below.

pip install --upgrade 'django>=3.2.21'

Details

In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/django

Introduced in: 3.2Fixed in: 3.2.21

Fixpip install --upgrade 'django>=3.2.21'

References

https://www.djangoproject.com/weblog/2023/sep/04/security-releases/[ARTICLE]
https://docs.djangoproject.com/en/4.2/releases/security/[WEB]
https://groups.google.com/forum/#!forum/django-announce[WEB]
https://github.com/advisories/GHSA-7h4p-27mh-hmrw[ADVISORY]