{"title":"Django 1.4.9 release notes","version":"dev","locale":"en","docname":"releases/1.4.9","url":"/en/dev/releases/1.4.9/","canonical":"https://djangodocs.dev/en/dev/releases/1.4.9/","summary":"Django 1.4.9 fixes a security-related bug in the 1.4 series and one other data corruption bug.","html":"<h1>Django 1.4.9 release notes<a class=\"heading-anchor\" href=\"#django-1-4-9-release-notes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h1>\n<p><em>October 23, 2013</em></p>\n<p>Django 1.4.9 fixes a security-related bug in the 1.4 series and one other\ndata corruption bug.</p>\n<section id=\"readdressed-denial-of-service-via-password-hashers\">\n<h2>Readdressed denial-of-service via password hashers<a class=\"heading-anchor\" href=\"#readdressed-denial-of-service-via-password-hashers\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<p>Django 1.4.8 imposes a 4096-byte limit on passwords in order to mitigate a\ndenial-of-service attack through submission of bogus but extremely large\npasswords. In Django 1.4.9, we’ve reverted this change and instead improved\nthe speed of our PBKDF2 algorithm by not rehashing the key on every iteration.</p>\n</section>\n<section id=\"bugfixes\">\n<h2>Bugfixes<a class=\"heading-anchor\" href=\"#bugfixes\"><span class=\"visually-hidden\">Link to this heading</span><span aria-hidden=\"true\">#</span></a></h2>\n<ul class=\"simple\">\n<li><p>Fixed a data corruption bug with <code class=\"docutils literal notranslate\">datetime_safe.datetime.combine</code> (#21256).</p></li>\n</ul>\n</section>","rootId":"django-1-4-9-release-notes","toc":[{"title":"Readdressed denial-of-service via password hashers","anchor":"readdressed-denial-of-service-via-password-hashers","children":[]},{"title":"Bugfixes","anchor":"bugfixes","children":[]}],"breadcrumbs":[{"docname":"releases/index","title":"Release notes","url":"/en/dev/releases/"}],"prev":{"docname":"releases/1.4.10","title":"Django 1.4.10 release notes","url":"/en/dev/releases/1.4.10/"},"next":{"docname":"releases/1.4.8","title":"Django 1.4.8 release notes","url":"/en/dev/releases/1.4.8/"},"formats":{"html":"/en/dev/releases/1.4.9/","markdown":"/en/dev/releases/1.4.9.md","json":"/en/dev/releases/1.4.9.json"},"source":"https://github.com/django/django/blob/main/docs/releases/1.4.9.txt","official":"https://docs.djangoproject.com/en/dev/releases/1.4.9/","inVersions":["dev","6.1","6.0","5.2","5.1","5.0","4.2","4.1","4.0","3.2","3.1","3.0","2.2","2.1","2.0","1.11","1.10","1.9","1.8"],"inLocales":["en"]}