CVE-2021-45115
published 2022-01-05CVE-2021-45115: An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
2.40%
81.9th percentile
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-django | < python-django 2:3.2.11-1 (bookworm) | python-django 2:3.2.11-1 (bookworm) |
| djangoproject | django | >= 2.2 < 2.2.26 | 2.2.26 |
| djangoproject | django | >= 2.2a1 < 2.2.26 | 2.2.26 |
| djangoproject | django | >= 3.2 < 3.2.11 | 3.2.11 |
| djangoproject | django | >= 3.2a1 < 3.2.11 | 3.2.11 |
| djangoproject | django | >= 4.0 < 4.0.1 | 4.0.1 |
| djangoproject | django | >= 4.0a1 < 4.0.1 | 4.0.1 |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Denial-of-service in Django
ghsa·2022-01-12
CVE-2021-45115 [HIGH] CWE-400 Denial-of-service in Django
Denial-of-service in Django
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. `UserAttributeSimilarityValidator` incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.
OSV
Denial-of-service in Django
osv·2022-01-12
CVE-2021-45115 [HIGH] Denial-of-service in Django
Denial-of-service in Django
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. `UserAttributeSimilarityValidator` incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.
OSV
CVE-2021-45115: An issue was discovered in Django 2
osv·2022-01-05·CVSS 7.5
CVE-2021-45115 [HIGH] CVE-2021-45115: An issue was discovered in Django 2
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.
OSV
python-django vulnerabilities
osv·2022-01-05·CVSS 7.5
CVE-2021-45115 [HIGH] python-django vulnerabilities
python-django vulnerabilities
Chris Bailey discovered that Django incorrectly handled evaluating
submitted passwords. A remote attacker could possibly use this issue to
consume resources, resulting in a denial of service. (CVE-2021-45115)
Dennis Brinkrolf discovered that Django incorrectly handled the dictsort
template filter. A remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2021-45116)
Dennis Brinkrolf discovered that Django incorrectly handled certain file
names. A remote attacker could possibly use this issue to save files to
arbitrary filesystem locations. (CVE-2021-45452)
Ubuntu
Django vulnerabilities
vendor_ubuntu·2022-01-05·CVSS 7.5
CVE-2021-45116 [HIGH] Django vulnerabilities
Title: Django vulnerabilities
Summary: Several security issues were fixed in Django.
Chris Bailey discovered that Django incorrectly handled evaluating
submitted passwords. A remote attacker could possibly use this issue to
consume resources, resulting in a denial of service. (CVE-2021-45115)
Dennis Brinkrolf discovered that Django incorrectly handled the dictsort
template filter. A remote attacker could possibly use this issue to obtain
sensitive information. (CVE-2021-45116)
Dennis Brinkrolf discovered that Django incorrectly handled certain file
names. A remote attacker could possibly use this issue to save files to
arbitrary filesystem locations. (CVE-2021-45452)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
django: Denial-of-service possibility in UserAttributeSimilarityValidator
vendor_redhat·2022-01-04·CVSS 7.5
CVE-2021-45115 [HIGH] CWE-400 django: Denial-of-service possibility in UserAttributeSimilarityValidator
django: Denial-of-service possibility in UserAttributeSimilarityValidator
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.
A resource-consumption flaw was found in django's UserAttributeSimilarityValidator, where it incurred significant overhead evaluating any submitted password that was artificially large relative to comparison values. A network attacker could exploit this flaw to cause a denial of service.
Statement: In Red Hat OpenStack Platform, be
Debian
CVE-2021-45115: python-django - An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 ...
vendor_debian·2021·CVSS 7.5
CVE-2021-45115 [HIGH] CVE-2021-45115: python-django - An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 ...
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.
Scope: local
bookworm: resolved (fixed in 2:3.2.11-1)
bullseye: resolved (fixed in 2:2.2.26-1~deb11u1)
forky: resolved (fixed in 2:3.2.11-1)
sid: resolved (fixed in 2:3.2.11-1)
trixie: resolved (fixed in 2:3.2.11-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://docs.djangoproject.com/en/4.0/releases/security/https://groups.google.com/forum/#%21forum/django-announcehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/https://security.netapp.com/advisory/ntap-20220121-0005/https://www.djangoproject.com/weblog/2022/jan/04/security-releases/https://docs.djangoproject.com/en/4.0/releases/security/https://groups.google.com/forum/#%21forum/django-announcehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B4SQG2EAF4WCI2SLRL6XRDJ3RPK3ZRDV/https://security.netapp.com/advisory/ntap-20220121-0005/https://www.djangoproject.com/weblog/2022/jan/04/security-releases/
2022-01-05
Published