22 lines
789 B
Plaintext
22 lines
789 B
Plaintext
|
==========================
|
||
|
|
Django 1.5.3 release notes
|
||
|
|
==========================
|
||
|
|
|
||
|
|
*September 14, 2013*
|
||
|
|
|
||
|
|
This is Django 1.5.4, the fourth release in the Django 1.5 series. It addresses
|
||
|
|
one security issue.
|
||
|
|
|
||
|
|
Denial-of-service via password hashers
|
||
|
|
--------------------------------------
|
||
|
|
|
||
|
|
In previous versions of Django no limit was imposed on the plaintext
|
||
|
|
length of a password. This allows a denial-of-service attack through
|
||
|
|
submission of bogus but extremely large passwords, tying up server
|
||
|
|
resources performing the (expensive, and increasingly expensive with
|
||
|
|
the length of the password) calculation of the corresponding hash.
|
||
|
|
|
||
|
|
As of 1.5.3, Django's authentication framework imposes a 4096-byte
|
||
|
|
limit on passwords, and will fail authentication with any submitted
|
||
|
|
password of greater length.
|