Denial-of-Service Vulnerability in Python-Django: CVE-2021-45115
Summary
UBUNTU-CVE-2021-45115: An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Affects python-django versions 1.5.4-1ubuntu1 – 1.6.11-0ubuntu1.3+esm7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications and provides a robust set of features for developers. However, certain versions of Django have been found to be vulnerable to a denial-of-service attack due to inefficient password validation mechanisms, particularly when handling large input sizes.
Vulnerability Detail
An issue was discovered in Django versions 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. The UserAttributeSimilarityValidator can incur significant overhead when evaluating a submitted password that is artificially large compared to the comparison values. This vulnerability can be exploited in scenarios where user registration is unrestricted, potentially leading to a denial-of-service attack by overwhelming the server with resource-intensive password validation requests.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider implementing input validation to restrict the size of passwords submitted during user registration. This can help mitigate the risk of denial-of-service attacks while a patch is being applied.
Conclusion
CVE-2021-45115 represents a significant vulnerability in Python-Django that can lead to denial-of-service attacks. It is crucial for users of affected versions to update their packages promptly and consider implementing workarounds to protect their applications until the update can be applied.
See every vulnerability recorded for python-django →
FAQ
CVE-2021-45115 is a vulnerability in certain versions of Python-Django that can lead to denial-of-service attacks due to inefficient password validation.
The affected versions include Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2021-45115 is 7.5, indicating a high severity level.
If an immediate update is not possible, implement input validation to restrict password sizes as a temporary measure to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
