PT-2022-1406 · Django+6 · Django+6
Chris Bailey
·
Published
2022-01-04
·
Updated
2026-01-03
·
CVE-2021-45115
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Django versions 2.2 through 2.2.25
Django versions 3.2 through 3.2.10
Django versions 4.0 through 4.0.0
Description
The issue is related to the
UserAttributeSimilarityValidator component in the Django framework, which can cause significant overhead when evaluating a large submitted password. This can lead to a potential denial-of-service attack if access to user registration is unrestricted. The vulnerability is related to an error in resource management, allowing a remote attacker to execute a denial-of-service attack by sending a specially crafted password to the application.Recommendations
For Django versions 2.2 through 2.2.25, update to version 2.2.26 or later.
For Django versions 3.2 through 3.2.10, update to version 3.2.11 or later.
For Django versions 4.0 through 4.0.0, update to version 4.0.1 or later.
As a temporary workaround, consider restricting access to user registration to minimize the risk of exploitation.
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Django
Linuxmint
Red Os
Rocky Linux
Ubuntu