diff options
| author | Michael Manfre <mike@manfre.net> | 2024-06-14 22:12:58 -0400 |
|---|---|---|
| committer | Natalia <124304+nessita@users.noreply.github.com> | 2024-07-09 09:42:29 -0300 |
| commit | f5d16483f3abfd33e301fb5c2005b80bd6d05aaf (patch) | |
| tree | 26eeffdb4c893acc55d8c91a36e100b24d6dae9d /docs | |
| parent | 44aef996c8d723198e89ca834cb1d746e2e72d77 (diff) | |
[5.1.x] Fixed CVE-2024-39329 -- Standarized timing of verify_password() when checking unusuable passwords.
Refs #20760.
Thanks Michael Manfre for the fix and to Adam Johnson for the review.
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/releases/4.2.14.txt | 7 | ||||
| -rw-r--r-- | docs/releases/5.0.7.txt | 7 |
2 files changed, 14 insertions, 0 deletions
diff --git a/docs/releases/4.2.14.txt b/docs/releases/4.2.14.txt index f32c0cf8d4..556cff4437 100644 --- a/docs/releases/4.2.14.txt +++ b/docs/releases/4.2.14.txt @@ -13,3 +13,10 @@ CVE-2024-38875: Potential denial-of-service vulnerability in ``django.utils.html :tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential denial-of-service attack via certain inputs with a very large number of brackets. + +CVE-2024-39329: Username enumeration through timing difference for users with unusable passwords +================================================================================================ + +The :meth:`~django.contrib.auth.backends.ModelBackend.authenticate()` method +allowed remote attackers to enumerate users via a timing attack involving login +requests for users with unusable passwords. diff --git a/docs/releases/5.0.7.txt b/docs/releases/5.0.7.txt index f25bc1f37d..53efe3766b 100644 --- a/docs/releases/5.0.7.txt +++ b/docs/releases/5.0.7.txt @@ -14,6 +14,13 @@ CVE-2024-38875: Potential denial-of-service vulnerability in ``django.utils.html denial-of-service attack via certain inputs with a very large number of brackets. +CVE-2024-39329: Username enumeration through timing difference for users with unusable passwords +================================================================================================ + +The :meth:`~django.contrib.auth.backends.ModelBackend.authenticate()` method +allowed remote attackers to enumerate users via a timing attack involving login +requests for users with unusable passwords. + Bugfixes ======== |