Timing attack in Django - CVE-2016-2513

Vulnerability identifier: #VU1605

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-2513

CWE-ID: CWE-208

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists in the password hasher in contrib/auth/hashers.py due to creating a timing difference between a login request for a user with a password encoded in an older number of iterations and login request for a nonexistent user. A remote attacker can enumerate users via a timing attack involving login requests.

Django
Debian Linux
Fedora
Ubuntu
py-django (Alpine package)
python-django (Red Hat package)
python-django
Red Hat OpenStack

Update to version 1.8.10 or 1.9.3.

py-django (Alpine package) - update to 1.8.10-r0
python-django (Red Hat package) - addressed in versions 1.6.11-5.el6ost, 1.6.11-5.el7ost
python-django - addressed in versions 1.6.11-5.el7, 1.8.10-1.fc22, 1.8.10-1.fc23, 1.8.11-1.fc22, 1.8.11-1.fc23

• https://www.djangoproject.com/weblog/2016/mar/01/security-releases/

• Multiple vulnerabilities in Django
• Ubuntu update for Django
• Ubuntu update for Django
• Ubuntu update for Django
• Debian update for python-django
• Red Hat update for python-django
• Red Hat update for python-django
• Timing attack in py-django (Alpine package)
• Fedora 23 update for python-django
• Fedora 22 update for python-django
• Fedora EPEL 7 update for python-django
• Fedora 23 update for python-django
• Fedora 22 update for python-django
• Red Hat Enterprise Linux OpenStack Platform 5 update for python-django
• Red Hat Enterprise Linux OpenStack Platform 6 update for python-django
• Red Hat Enterprise Linux OpenStack Platform 5 update for python-django