CVE-2024-39329

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.

Read the notes from the security team

Why is this CVE low priority?

requires user accounts with unusable passwords

Learn more about Ubuntu priority

Status

Show unmaintained releases

Package	Ubuntu Release	Status
python-django	24.10 oracular	Not affected
	24.04 LTS noble	Fixed 3:4.2.11-1ubuntu1.1
	23.10 mantic	Fixed 3:4.2.4-1ubuntu2.3
	22.04 LTS jammy	Fixed 2:3.2.12-2ubuntu1.12
	20.04 LTS focal	Fixed 2:2.2.12-1ubuntu0.23
	18.04 LTS bionic	Fixed 1:1.11.11-1ubuntu1.21+esm5 Ubuntu Pro
	16.04 LTS xenial	Needs evaluation
	14.04 LTS trusty	Needs evaluation

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro

Notes

alexmurray

upstream advises that only versions 4.2, 5.0 and 5.1 (plus main development branch) are affected but it is likely earlier versions may also be affected but upstream do not mention this as they are no longer maintained by them

References

Related Ubuntu Security Notices (USN)

USN-6888-1
Django vulnerabilities
9 July 2024

USN-6888-2
Django vulnerabilities
11 July 2024

Other references

https://www.cve.org/CVERecord?id=CVE-2024-39329