PT-2024-24934 · Unknown+1 · Python Social Auth+1

Bradenmacdonald · Published 2024-04-24 · Updated 2024-06-15 · CVE-2024-32879

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.4.1

Description The issue arises due to default case-insensitive collation in MySQL or MariaDB databases, causing third-party authentication user IDs to not be case-sensitive. This could lead to different IDs matching. The problem has been addressed by a fix released in version 5.4.1.

Recommendations For versions prior to 5.4.1, update to version 5.4.1 to resolve the issue. As a temporary workaround, consider changing the collation of the affected field, for example, by running the SQL command: ALTER TABLE social auth usersocialauth MODIFY uid varchar(255) COLLATE utf8 bin;

Exploit

Fix

Weakness Enumeration

CWE-303

CWE-178

Related Identifiers

CVE-2024-32879

GHSA-2GR8-3WC7-XHJ3

OPENSUSE-SU-2024:14036-1

RHSA-2024:3781

RHSA-2024:6428

Affected Products

Debian

Python Social Auth

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32879.json · Exploit
• https://cve.org/CVERecord?id=CVE-2024-32879 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-32879 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2gr8-3wc7-xhj3 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-32879 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14036-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-32879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32879 · Security Note
• https://ubuntu.com/security/CVE-2024-32879 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32879 · Vendor Advisory
• https://github.com/python-social-auth/social-app-django · Note
• https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-2gr8-3wc7-xhj3 · Note
• https://github.com/python-social-auth/social-app-django/pull/566 · Note
• https://github.com/python-social-auth/social-app-django/commit/31c3e0c7edb187004d8abbde7e9c4f7ef9098138 · Note
• https://suse.com/security/cve/CVE-2024-32879 · Note