From f5d16483f3abfd33e301fb5c2005b80bd6d05aaf Mon Sep 17 00:00:00 2001 From: Michael Manfre Date: Fri, 14 Jun 2024 22:12:58 -0400 Subject: [5.1.x] Fixed CVE-2024-39329 -- Standarized timing of verify_password() when checking unusuable passwords. Refs #20760. Thanks Michael Manfre for the fix and to Adam Johnson for the review. --- docs/releases/4.2.14.txt | 7 +++++++ docs/releases/5.0.7.txt | 7 +++++++ 2 files changed, 14 insertions(+) (limited to 'docs') diff --git a/docs/releases/4.2.14.txt b/docs/releases/4.2.14.txt index f32c0cf8d4..556cff4437 100644 --- a/docs/releases/4.2.14.txt +++ b/docs/releases/4.2.14.txt @@ -13,3 +13,10 @@ CVE-2024-38875: Potential denial-of-service vulnerability in ``django.utils.html :tfilter:`urlize` and :tfilter:`urlizetrunc` were subject to a potential denial-of-service attack via certain inputs with a very large number of brackets. + +CVE-2024-39329: Username enumeration through timing difference for users with unusable passwords +================================================================================================ + +The :meth:`~django.contrib.auth.backends.ModelBackend.authenticate()` method +allowed remote attackers to enumerate users via a timing attack involving login +requests for users with unusable passwords. diff --git a/docs/releases/5.0.7.txt b/docs/releases/5.0.7.txt index f25bc1f37d..53efe3766b 100644 --- a/docs/releases/5.0.7.txt +++ b/docs/releases/5.0.7.txt @@ -14,6 +14,13 @@ CVE-2024-38875: Potential denial-of-service vulnerability in ``django.utils.html denial-of-service attack via certain inputs with a very large number of brackets. +CVE-2024-39329: Username enumeration through timing difference for users with unusable passwords +================================================================================================ + +The :meth:`~django.contrib.auth.backends.ModelBackend.authenticate()` method +allowed remote attackers to enumerate users via a timing attack involving login +requests for users with unusable passwords. + Bugfixes ======== -- cgit v1.3