CVE-2021-45115: High severity djangoproject Django vulnerability
:class:.UserAttributeSimilarityValidator incurred significant overhead evaluating submitted password that were artificially large in relative to the comparison values. On the assumption that access to user registration was unrestricted this provided a potential vector for a denial-of-service attack.
References:
https://www.djangoproject.com/weblog/2022/jan/04/security-releases/
Other sources
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.
— GitHub
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 4.0.1 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 3.2.11 - Upgrade
Upgrade
redhat/Djangoto a version that resolves this vulnerability.Fixed in 2.2.26 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.0.1 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 3.2.11 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 2.2.26 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 3.2.12-r0 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 2.2.26 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 3.2.11 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 4.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2021-45115?
The severity of CVE-2021-45115 is high with a severity value of 7.5.
What versions of Django are affected by CVE-2021-45115?
Django versions 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 are affected by CVE-2021-45115.
What is the remedy for CVE-2021-45115?
The remedy for CVE-2021-45115 is to update Django to version 4.0.1, 3.2.11, or 2.2.26.
Where can I find more information about CVE-2021-45115?
You can find more information about CVE-2021-45115 on the Django website and the Red Hat Bugzilla.
What is the Common Weakness Enumeration (CWE) for CVE-2021-45115?
CVE-2021-45115 is associated with CWE-400 (Uncontrolled Resource Consumption).