CVE-2021-45115

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 56%
VendorProductVersion
djangoprojectdjango
2.2 ≤
𝑥
< 2.2.26
djangoprojectdjango
3.2 ≤
𝑥
< 3.2.11
djangoprojectdjango
4.0 ≤
𝑥
< 4.0.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
python-django
bullseye (security)
2:2.2.28-1~deb11u2
fixed
bullseye
2:2.2.28-1~deb11u2
fixed
stretch
postponed
bookworm
3:3.2.19-1+deb12u1
fixed
bookworm (security)
3:3.2.19-1+deb12u1
fixed
sid
3:4.2.16-1
fixed
trixie
3:4.2.16-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-django
noble
Fixed 2:3.2.11-1
released
mantic
Fixed 2:3.2.11-1
released
lunar
Fixed 2:3.2.11-1
released
kinetic
Fixed 2:3.2.11-1
released
jammy
Fixed 2:3.2.11-1
released
impish
Fixed 2:2.2.24-1ubuntu1.2
released
hirsute
Fixed 2:2.2.20-1ubuntu0.4
released
focal
Fixed 2:2.2.12-1ubuntu0.9
released
bionic
Fixed 1:1.11.11-1ubuntu1.15
released
xenial
needed
trusty
needed