[4.2.x] Fixed CVE-2024-39329 -- Standarized timing of verify_password() when checking unusuable passwords.

Refs #20760.

Thanks Michael Manfre for the fix and to Adam Johnson for the review.

1 files changed, 8 insertions, 2 deletions

diff --git a/django/contrib/auth/hashers.py b/django/contrib/auth/hashers.py
index 9db5a12e13..f11bc8a0f3 100644
--- a/django/contrib/auth/hashers.py
+++ b/django/contrib/auth/hashers.py
@@ -43,14 +43,20 @@ def check_password(password, encoded, setter=None, preferred="default"):
     If setter is specified, it'll be called when you need to
     regenerate the password.
     """
-    if password is None or not is_password_usable(encoded):
-        return False
+    fake_runtime = password is None or not is_password_usable(encoded)
 
     preferred = get_hasher(preferred)
     try:
         hasher = identify_hasher(encoded)
     except ValueError:
         # encoded is gibberish or uses a hasher that's no longer installed.
+        fake_runtime = True
+
+    if fake_runtime:
+        # Run the default password hasher once to reduce the timing difference
+        # between an existing user with an unusable password and a nonexistent
+        # user or missing hasher (similar to #20760).
+        make_password(get_random_string(UNUSABLE_PASSWORD_SUFFIX_LENGTH))
         return False
 
     hasher_changed = hasher.algorithm != preferred.algorithm