mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

Fixed CVE-2021-45115 -- Prevented DoS vector in UserAttributeSimilarityValidator.

Browse Source 
Thanks Chris Bailey for the report.

Co-authored-by: Adam Johnson <me@adamj.eu>
This commit is contained in:
Florian Apolloner
2021-12-27 14:48:03 +01:00
committed by Carlton Gibson
parent ccafad2e42
commit 968a3d01fa
6 changed files with 92 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
docs/releases/3.2.11.txt
View File

@@ -7,4 +7,16 @@ Django 3.2.11 release notes
Django 3.2.11 fixes one security issue with severity "medium" and two security
issues with severity "low" in 3.2.10.
...
CVE-2021-45115: Denial-of-service possibility in ``UserAttributeSimilarityValidator``
=====================================================================================
:class:`.UserAttributeSimilarityValidator` incurred significant overhead
evaluating submitted password that were artificially large in relative to the
comparison values. On the assumption that access to user registration was
unrestricted this provided a potential vector for a denial-of-service attack.
In order to mitigate this issue, relatively long values are now ignored by
``UserAttributeSimilarityValidator``.
This issue has severity "medium" according to the :ref:`Django security policy
<security-disclosure>`.