Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2021-45115: Django Password Validation Overload Can Cause Slow Performance
CVE-2021-45115 · published 4 years ago
Summary
Django versions 2.2 to 4.0 have a bug that can cause slow performance when registering new users with very long passwords. This can be exploited to overload the system and make it harder for legitimate users to register. To fix this, update to Django 2.2.26 or later, 3.2.11 or later, or 4.0.1 or later.
What to do
- Update canonical python-django to version 1:1.11.11-1ubuntu1.15.
- Update canonical python-django to version 2:2.2.12-1ubuntu0.9.
- Update django software foundation django to version 2.2.26.
- Update django software foundation django to version 3.2.11.
- Update django software foundation django to version 4.0.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | djangoproject | django |
>= 2.2, < 2.2.26 >= 3.2, < 3.2.11 >= 4.0, < 4.0.1 cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
35 cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
| Ubuntu:Pro:14.04:LTS | canonical | python-django | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | python-django | All versions |
| Ubuntu:18.04:LTS | canonical | python-django |
< 1:1.11.11-1ubuntu1.15 Fix: upgrade to 1:1.11.11-1ubuntu1.15
|
| Ubuntu:20.04:LTS | canonical | python-django |
< 2:2.2.12-1ubuntu0.9 Fix: upgrade to 2:2.2.12-1ubuntu0.9
|
| pip | django software foundation | django |
>= 2.2a1, < 2.2.26 >= 3.2a1, < 3.2.11 >= 4.0a1, < 4.0.1 Fix: upgrade to 2.2.26
|
Original advisory text
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that ...
An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-45115
- https://github.com/advisories/GHSA-53qw-q765-4fww
- https://groups.google.com/forum/#!forum/django-announce
- https://github.com/django/django/commit/2135637fdd5ce994de110affef9e67dffdf77277
- https://github.com/django/django/commit/a8b32fe13bcaed1c0b772fdc53de84abc224fb20
- https://github.com/django/django/commit/df79ef03ac867c93caaa6be56bc69e66abfeef8f
- https://docs.djangoproject.com/en/4.0/releases/security
- https://lists.fedoraproject.org/archives/list/[email protected]...
- https://security.netapp.com/advisory/ntap-20220121-0005
- https://www.djangoproject.com/weblog/2022/jan/04/security-releases
- https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2022-1.ya...
- https://docs.djangoproject.com/en/4.0/releases/security/ Patch Vendor Advisory
- https://groups.google.com/forum/#%21forum/django-announce
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://security.netapp.com/advisory/ntap-20220121-0005/ Third Party Advisory
- https://www.djangoproject.com/weblog/2022/jan/04/security-releases/ Patch Vendor Advisory
- https://ubuntu.com/security/CVE-2021-45115 Third Party Advisory
- https://ubuntu.com/security/notices/USN-5204-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-45115 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published5 Jan 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta