From 156d3186c96e3ec2ca73b8b25dc2ef366e38df14 Mon Sep 17 00:00:00 2001 From: Michael Manfre Date: Fri, 14 Jun 2024 22:12:58 -0400 Subject: [4.2.x] Fixed CVE-2024-39329 -- Standarized timing of verify_password() when checking unusuable passwords. Refs #20760. Thanks Michael Manfre for the fix and to Adam Johnson for the review. --- django/contrib/auth/hashers.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) (limited to 'django') diff --git a/django/contrib/auth/hashers.py b/django/contrib/auth/hashers.py index 9db5a12e13..f11bc8a0f3 100644 --- a/django/contrib/auth/hashers.py +++ b/django/contrib/auth/hashers.py @@ -43,14 +43,20 @@ def check_password(password, encoded, setter=None, preferred="default"): If setter is specified, it'll be called when you need to regenerate the password. """ - if password is None or not is_password_usable(encoded): - return False + fake_runtime = password is None or not is_password_usable(encoded) preferred = get_hasher(preferred) try: hasher = identify_hasher(encoded) except ValueError: # encoded is gibberish or uses a hasher that's no longer installed. + fake_runtime = True + + if fake_runtime: + # Run the default password hasher once to reduce the timing difference + # between an existing user with an unusable password and a nonexistent + # user or missing hasher (similar to #20760). + make_password(get_random_string(UNUSABLE_PASSWORD_SUFFIX_LENGTH)) return False hasher_changed = hasher.algorithm != preferred.algorithm -- cgit v1.3