[ASA-201810-5] python-django: information disclosure
Jelle van der Waa
jelle at archlinux.org
Wed Oct 3 20:01:44 UTC 2018
Arch Linux Security Advisory ASA-201810-5
Date : 2018-10-01
CVE-ID : CVE-2018-16984
Package : python-django
Type : information disclosure
Remote : Yes
Link : https://security.archlinux.org/AVG-773
The package python-django before version 2.1.2-1 is vulnerable to
Upgrade to 2.1.2-1.
# pacman -Syu "python-django>=2.1.2-1"
The problem has been fixed upstream in version 2.1.2.
If an admin user has the change permission to the user model, only part
of the password hash is displayed in the change form. Admin users with
the view (but not change) permission to the user model were displayed
the entire hash. While it's typically infeasible to reverse a strong
password hash, if your site uses weaker password hashing algorithms
such as MD5 or SHA1, it could be a problem.
A remote authenticated administrator with change permissions is able to
obtain the password hashes of users.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 488 bytes
Desc: not available
More information about the arch-security