[4.2.x] Fixed CVE-2023-46695 -- Fixed potential DoS in UsernameField on Windows.

felixxm · felixxm · commit 048a9ebb6ea4 · 2023-11-01T06:19:20.000+01:00
Thanks MProgrammer (https://hackerone.com/mprogrammer) for the report.
diff --git a/django/contrib/auth/forms.py b/django/contrib/auth/forms.py
@@ -71,7 +71,15 @@ def __init__(self, *args, **kwargs):
 
 class UsernameField(forms.CharField):
     def to_python(self, value):
-        return unicodedata.normalize("NFKC", super().to_python(value))
+        value = super().to_python(value)
+        if self.max_length is not None and len(value) > self.max_length:
+            # Normalization can increase the string length (e.g.
+            # "ﬀ" -> "ff", "½" -> "1⁄2") but cannot reduce it, so there is no
+            # point in normalizing invalid data. Moreover, Unicode
+            # normalization is very slow on Windows and can be a DoS attack
+            # vector.
+            return value
+        return unicodedata.normalize("NFKC", value)
 
     def widget_attrs(self, widget):
         return {
diff --git a/docs/releases/3.2.23.txt b/docs/releases/3.2.23.txt
@@ -6,4 +6,14 @@ Django 3.2.23 release notes
 
 Django 3.2.23 fixes a security issue with severity "moderate" in 3.2.22.
 
-...
+CVE-2023-46695: Potential denial of service vulnerability in ``UsernameField`` on Windows
+=========================================================================================
+
+The :func:`NFKC normalization <python:unicodedata.normalize>` is slow on
+Windows. As a consequence, ``django.contrib.auth.forms.UsernameField`` was
+subject to a potential denial of service attack via certain inputs with a very
+large number of Unicode characters.
+
+In order to avoid the vulnerability, invalid values longer than
+``UsernameField.max_length`` are no longer normalized, since they cannot pass
+validation anyway.
diff --git a/docs/releases/4.1.13.txt b/docs/releases/4.1.13.txt
@@ -6,4 +6,14 @@ Django 4.1.13 release notes
 
 Django 4.1.13 fixes a security issue with severity "moderate" in 4.1.12.
 
-...
+CVE-2023-46695: Potential denial of service vulnerability in ``UsernameField`` on Windows
+=========================================================================================
+
+The :func:`NFKC normalization <python:unicodedata.normalize>` is slow on
+Windows. As a consequence, ``django.contrib.auth.forms.UsernameField`` was
+subject to a potential denial of service attack via certain inputs with a very
+large number of Unicode characters.
+
+In order to avoid the vulnerability, invalid values longer than
+``UsernameField.max_length`` are no longer normalized, since they cannot pass
+validation anyway.
diff --git a/docs/releases/4.2.7.txt b/docs/releases/4.2.7.txt
@@ -7,6 +7,18 @@ Django 4.2.7 release notes
 Django 4.2.7 fixes a security issue with severity "moderate" and several bugs
 in 4.2.6.
 
+CVE-2023-46695: Potential denial of service vulnerability in ``UsernameField`` on Windows
+=========================================================================================
+
+The :func:`NFKC normalization <python:unicodedata.normalize>` is slow on
+Windows. As a consequence, ``django.contrib.auth.forms.UsernameField`` was
+subject to a potential denial of service attack via certain inputs with a very
+large number of Unicode characters.
+
+In order to avoid the vulnerability, invalid values longer than
+``UsernameField.max_length`` are no longer normalized, since they cannot pass
+validation anyway.
+
 Bugfixes
 ========
 
diff --git a/tests/auth_tests/test_forms.py b/tests/auth_tests/test_forms.py
@@ -14,6 +14,7 @@
     SetPasswordForm,
     UserChangeForm,
     UserCreationForm,
+    UsernameField,
 )
 from django.contrib.auth.models import User
 from django.contrib.auth.signals import user_login_failed
@@ -154,6 +155,12 @@ def test_normalize_username(self):
         self.assertNotEqual(user.username, ohm_username)
         self.assertEqual(user.username, "testΩ")  # U+03A9 GREEK CAPITAL LETTER OMEGA
 
+    def test_invalid_username_no_normalize(self):
+        field = UsernameField(max_length=254)
+        # Usernames are not normalized if they are too long.
+        self.assertEqual(field.to_python("½" * 255), "½" * 255)
+        self.assertEqual(field.to_python("ﬀ" * 254), "ff" * 254)
+
     def test_duplicate_normalized_unicode(self):
         """
         To prevent almost identical usernames, visually identical but differing
