CVE-2021-45115: High severity django vulnerability
:class:.UserAttributeSimilarityValidator incurred significant overhead evaluating submitted password that were artificially large in relative to the comparison values. On the assumption that access to user registration was unrestricted this provided a potential vector for a denial-of-service attack.
References:
https://www.djangoproject.com/weblog/2022/jan/04/security-releases/
Other sources
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.
— GitHub
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-45115?
The severity of CVE-2021-45115 is high with a severity value of 7.5.
What versions of Django are affected by CVE-2021-45115?
Django versions 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 are affected by CVE-2021-45115.
What is the remedy for CVE-2021-45115?
The remedy for CVE-2021-45115 is to update Django to version 4.0.1, 3.2.11, or 2.2.26.
Where can I find more information about CVE-2021-45115?
You can find more information about CVE-2021-45115 on the Django website and the Red Hat Bugzilla.
What is the Common Weakness Enumeration (CWE) for CVE-2021-45115?
CVE-2021-45115 is associated with CWE-400 (Uncontrolled Resource Consumption).