CVE-2024-39329
Publication date 9 July 2024
Last updated 24 July 2024
Ubuntu priority
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.
Read the notes from the security team
Why is this CVE low priority?
requires user accounts with unusable passwords
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| python-django | 24.10 oracular |
Not affected
|
| 24.04 LTS noble |
Fixed 3:4.2.11-1ubuntu1.1
|
|
| 22.04 LTS jammy |
Fixed 2:3.2.12-2ubuntu1.12
|
|
| 20.04 LTS focal |
Fixed 2:2.2.12-1ubuntu0.23
|
|
| 18.04 LTS bionic |
Fixed 1:1.11.11-1ubuntu1.21+esm5
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty | Ignored end of ESM support, was needs-triage |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProNotes
alexmurray
upstream advises that only versions 4.2, 5.0 and 5.1 (plus main development branch) are affected but it is likely earlier versions may also be affected but upstream do not mention this as they are no longer maintained by them
References
Related Ubuntu Security Notices (USN)
- USN-6888-1
- Django vulnerabilities
- 9 July 2024
- USN-6888-2
- Django vulnerabilities
- 11 July 2024