Improper Handling of Case Sensitivity in Python Social Auth - Django - CVE-2024-32879

Vulnerability identifier: #VU89132

CSH Severity: Medium

CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2024-32879

CWE-ID: CWE-178

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to default case-insensitive collation in MySQL or MariaDB databases. A remote user can bypass authentication process and gain unauthorized access to the application.

Python Social Auth - Django
Storage Defender - Resiliency Service
Cloud Pak for Network Automation
Nautobot
python3x-sqlparse (Red Hat package)
python-sqlparse (Red Hat package)
python3x-jmespath (Red Hat package)
python-jmespath (Red Hat package)
python3x-pulp-ansible (Red Hat package)
python-pulp-ansible (Red Hat package)
ansible-rulebook (Red Hat package)
automation-eda-controller (Red Hat package)
receptor (Red Hat package)
python3x-pydantic (Red Hat package)
python-pydantic (Red Hat package)
python3x-grpcio (Red Hat package)
python-grpcio (Red Hat package)
ansible-automation-platform-installer (Red Hat package)
ansible-core (Red Hat package)
python3x-requests (Red Hat package)
python-requests (Red Hat package)
python3x-jinja2 (Red Hat package)
python-jinja2 (Red Hat package)
python3x-idna (Red Hat package)
python-idna (Red Hat package)
python3x-aiohttp (Red Hat package)
python-aiohttp (Red Hat package)
python-zipp (Red Hat package)
python3x-pulpcore (Red Hat package)
python-pulpcore (Red Hat package)
python3x-django (Red Hat package)
python-django (Red Hat package)
automation-controller (Red Hat package)
automation-hub (Red Hat package)
python3x-galaxy-ng (Red Hat package)
python-galaxy-ng (Red Hat package)
python3x-social-auth-app-django (Red Hat package)
python-social-auth-app-django (Red Hat package)
python3x-pillow (Red Hat package)
python-pillow (Red Hat package)
python3x-gunicorn (Red Hat package)
python-gunicorn (Red Hat package)
python3x-black (Red Hat package)
python-black (Red Hat package)
python3x-pyOpenSSL (Red Hat package)
python-pyOpenSSL (Red Hat package)
python3x-cryptography (Red Hat package)
python-cryptography (Red Hat package)
Ansible Automation Platform

Install updates from vendor's website.

Python Social Auth - Django - update to 5.4.1
Storage Defender - Resiliency Service - update to 2.0.5
Nautobot - update to 2.2.3
python3x-sqlparse (Red Hat package) - update to 0.5.0-1.el8ap
python-sqlparse (Red Hat package) - update to 0.5.0-1.el9ap
python3x-jmespath (Red Hat package) - update to 0.10.0-5.el8ap
python-jmespath (Red Hat package) - update to 0.10.0-5.el9ap
python3x-pulp-ansible (Red Hat package) - addressed in versions 0.20.7-1.el8ap, 0.20.8-1.el8ap
python-pulp-ansible (Red Hat package) - addressed in versions 0.20.7-1.el9ap, 0.20.8-1.el9ap
ansible-rulebook (Red Hat package) - addressed in versions 1.0.7-1.el8ap, 1.0.7-1.el9ap
automation-eda-controller (Red Hat package) - addressed in versions 1.0.7-1.el8ap, 1.0.7-1.el9ap
receptor (Red Hat package) - addressed in versions 1.4.8-1.el8ap, 1.4.8-1.el9ap
python3x-pydantic (Red Hat package) - update to 1.10.15-1.el8ap
python-pydantic (Red Hat package) - update to 1.10.15-1.el9ap
python3x-grpcio (Red Hat package) - update to 1.58.3-1.el8ap
python-grpcio (Red Hat package) - update to 1.58.3-1.el9ap
Ansible Automation Platform - update to 2.4
ansible-automation-platform-installer (Red Hat package) - addressed in versions 2.4-7.1.el8ap, 2.4-7.1.el9ap
Cloud Pak for Network Automation - update to 2.7.5
ansible-core (Red Hat package) - addressed in versions 2.15.11-1.el8ap, 2.15.11-1.el9ap
python3x-requests (Red Hat package) - update to 2.32.2-1.el8ap
python-requests (Red Hat package) - update to 2.32.2-1.el9ap
python3x-jinja2 (Red Hat package) - update to 3.1.4-1.el8ap
python-jinja2 (Red Hat package) - update to 3.1.4-1.el9ap
python3x-idna (Red Hat package) - update to 3.7-1.el8ap
python-idna (Red Hat package) - update to 3.7-1.el9ap
python3x-aiohttp (Red Hat package) - update to 3.9.5-1.el8ap
python-aiohttp (Red Hat package) - update to 3.9.5-1.el9ap
python-zipp (Red Hat package) - update to 3.19.2-1.el9ap
python3x-pulpcore (Red Hat package) - addressed in versions 3.28.27-1.el8ap, 3.28.31-1.el8ap
python-pulpcore (Red Hat package) - addressed in versions 3.28.27-1.el9ap, 3.28.31-1.el9ap
python3x-django (Red Hat package) - update to 4.2.15-1.el8ap
python-django (Red Hat package) - update to 4.2.15-1.el9ap
automation-controller (Red Hat package) - addressed in versions 4.5.7-1.el8ap, 4.5.7-1.el9ap, 4.5.10-1.el8ap, 4.5.10-1.el9ap
automation-hub (Red Hat package) - addressed in versions 4.9.2-1.el8ap, 4.9.2-1.el9ap
python3x-galaxy-ng (Red Hat package) - update to 4.9.2-1.el8ap
python-galaxy-ng (Red Hat package) - update to 4.9.2-1.el9ap
python3x-social-auth-app-django (Red Hat package) - update to 5.4.1-1.el8ap
python-social-auth-app-django (Red Hat package) - update to 5.4.1-1.el9ap
python3x-pillow (Red Hat package) - update to 10.3.0-1.el8ap
python-pillow (Red Hat package) - update to 10.3.0-1.el9ap
python3x-gunicorn (Red Hat package) - addressed in versions 22.0.0-1.el8ap, 22.0.0-2.el8ap
python-gunicorn (Red Hat package) - addressed in versions 22.0.0-1.el9ap, 22.0.0-2.el9ap
python3x-black (Red Hat package) - update to 22.8.0-2.el8ap
python-black (Red Hat package) - update to 22.8.0-2.el9ap
python3x-pyOpenSSL (Red Hat package) - update to 24.1.0-1.el8ap
python-pyOpenSSL (Red Hat package) - update to 24.1.0-1.el9ap
python3x-cryptography (Red Hat package) - update to 42.0.5-1.el8ap
python-cryptography (Red Hat package) - update to 42.0.5-1.el9ap

• https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-2gr8-3wc7-xhj3
• https://github.com/python-social-auth/social-app-django/pull/566
• https://github.com/python-social-auth/social-app-django/commit/31c3e0c7edb187004d8abbde7e9c4f7ef9098138

• Improper Handling of Case Sensitivity in Python Social Auth - Django
• Improper Handling of Case Sensitivity in Nautobot
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Ansible Automation Platform 2.4 packages