CVE-2024-39329: Django CVE-2024-38875, CVE-2024-39329, CVE-2024-39330, and CVE-2024-39614
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.
Other sources
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.
— NVD
Django could allow a remote attacker to obtain sensitive information, caused by a flaw in the contrib.auth.backends.ModelBackend.authenticate() method. By utilize timing attack techniques, an attacker could exploit this vulnerability to enumerate users information, and use this information to launch further attacks against the affected system.
— IBM
The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with unusable passwords.
Affected versions =================
Django main development branch Django 5.1 Django 5.0 Django 4.2
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 4.2.14 - Upgrade
Upgrade
pip/Djangoto a version that resolves this vulnerability.Fixed in 5.0.7 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.25-0+deb12u1 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:4.2.14-1 - Upgrade
Upgrade
alpine/py3-djangoto a version that resolves this vulnerability.Fixed in 4.2.16-r0 - Upgrade
Upgrade
debian/python-djangoto a version that resolves this vulnerability.Fixed in 3:3.2.25-0+deb12u3Fixed in 3:3.2.25-0+deb12u6Fixed in 3:4.2.28-0+deb13u2Fixed in 3:4.2.28-0+deb13u1Fixed in 3:5.2.17-2Fixed in 3:5.2.19-1 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.0.7 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 4.2.14
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39329?
CVE-2024-39329 is classified as a security vulnerability that allows remote attackers to enumerate users.
How do I fix CVE-2024-39329?
To fix CVE-2024-39329, upgrade Django to version 5.0.7 or 4.2.14.
Which Django versions are affected by CVE-2024-39329?
CVE-2024-39329 affects Django versions 5.0 up to 5.0.6 and 4.2 up to 4.2.13.
What kind of attack does CVE-2024-39329 involve?
CVE-2024-39329 involves a timing attack that can be used to enumerate users based on login attempts.
Is there a workaround for CVE-2024-39329?
There are no specific workarounds documented for CVE-2024-39329 other than upgrading to a secure version.