From 156d3186c96e3ec2ca73b8b25dc2ef366e38df14 Mon Sep 17 00:00:00 2001 From: Michael Manfre Date: Fri, 14 Jun 2024 22:12:58 -0400 Subject: [4.2.x] Fixed CVE-2024-39329 -- Standarized timing of verify_password() when checking unusuable passwords. Refs #20760. Thanks Michael Manfre for the fix and to Adam Johnson for the review. --- docs/releases/4.2.14.txt | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'docs') diff --git a/docs/releases/4.2.14.txt b/docs/releases/4.2.14.txt index f32c0cf8d4..556cff4437 100644 --- a/docs/releases/4.2.14.txt +++ b/docs/releases/4.2.14.txt @@ -13,3 +13,10 @@ CVE-2024-38875: Potential denial-of-service vulnerability in ``django.utils.html :tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential denial-of-service attack via certain inputs with a very large number of brackets. + +CVE-2024-39329: Username enumeration through timing difference for users with unusable passwords +================================================================================================ + +The :meth:`~django.contrib.auth.backends.ModelBackend.authenticate()` method +allowed remote attackers to enumerate users via a timing attack involving login +requests for users with unusable passwords. -- cgit v1.3