CVE-2021-45115

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.

Affected Software

Name	Vendor	Start Version	End Version
Django	Djangoproject	2.2 (including)	2.2.26 (excluding)
Django	Djangoproject	3.2 (including)	3.2.11 (excluding)
Django	Djangoproject	4.0 (including)	4.0.1 (excluding)
Red Hat Satellite 6.11 for RHEL 8	RedHat	python-django-0:3.2.13-1.el8pc	*
Red Hat Satellite 6.11 for RHEL 8	RedHat	python-django-0:3.2.13-1.el8pc	*
Python-django	Ubuntu	bionic	*
Python-django	Ubuntu	devel	*
Python-django	Ubuntu	esm-infra-legacy/trusty	*
Python-django	Ubuntu	esm-infra/bionic	*
Python-django	Ubuntu	esm-infra/focal	*
Python-django	Ubuntu	esm-infra/xenial	*
Python-django	Ubuntu	focal	*
Python-django	Ubuntu	hirsute	*
Python-django	Ubuntu	impish	*
Python-django	Ubuntu	jammy	*
Python-django	Ubuntu	kinetic	*
Python-django	Ubuntu	lunar	*
Python-django	Ubuntu	mantic	*
Python-django	Ubuntu	noble	*
Python-django	Ubuntu	oracular	*
Python-django	Ubuntu	plucky	*
Python-django	Ubuntu	questing	*
Python-django	Ubuntu	trusty/esm	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-45115
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html

Affected Software

References