Arch Linux Security Advisory ASA-201810-5 ========================================= Severity: Medium Date : 2018-10-01 CVE-ID : CVE-2018-16984 Package : python-django Type : information disclosure Remote : Yes Link : https://security.archlinux.org/AVG-773 Summary ======= The package python-django before version 2.1.2-1 is vulnerable to information disclosure. Resolution ========== Upgrade to 2.1.2-1. # pacman -Syu "python-django>=2.1.2-1" The problem has been fixed upstream in version 2.1.2. Workaround ========== None. Description =========== If an admin user has the change permission to the user model, only part of the password hash is displayed in the change form. Admin users with the view (but not change) permission to the user model were displayed the entire hash. While it's typically infeasible to reverse a strong password hash, if your site uses weaker password hashing algorithms such as MD5 or SHA1, it could be a problem. Impact ====== A remote authenticated administrator with change permissions is able to obtain the password hashes of users. References ========== https://www.djangoproject.com/weblog/2018/oct/01/security-release/ https://github.com/django/django/commit/c4bd5b597e0aa2432e4c867b86650f18af11... https://security.archlinux.org/CVE-2018-16984