[ASA-201810-5] python-django: information disclosure

[Jelle van der Waa]

Arch Linux Security Advisory ASA-201810-5
=========================================

Severity: Medium
Date    : 2018-10-01
CVE-ID  : CVE-2018-16984
Package : python-django
Type    : information disclosure
Remote  : Yes
Link    : https://security.archlinux.org/AVG-773

Summary
=======

The package python-django before version 2.1.2-1 is vulnerable to
information disclosure.

Resolution
==========

Upgrade to 2.1.2-1.

# pacman -Syu "python-django>=2.1.2-1"

The problem has been fixed upstream in version 2.1.2.

Workaround
==========

None.

Description
===========

If an admin user has the change permission to the user model, only part
of the password hash is displayed in the change form. Admin users with
the view (but not change) permission to the user model were displayed
the entire hash. While it's typically infeasible to reverse a strong
password hash, if your site uses weaker password hashing algorithms
such as MD5 or SHA1, it could be a problem.

Impact
======

A remote authenticated administrator with change permissions is able to
obtain the password hashes of users.

References
==========

https://www.djangoproject.com/weblog/2018/oct/01/security-release/
https://github.com/django/django/commit/c4bd5b597e0aa2432e4c867b86650f18af117851
https://security.archlinux.org/CVE-2018-16984
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20181003/f3167beb/attachment.asc>