DemoBook a demo

Vulnerability advisory

CVE-2024-39329

Published Updated OSV record ↗

Also known as BIT-django-2024-39329GHSA-x7q2-wr7g-xqmfPYSEC-2024-57

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/django/django ↗
97aa3b7f08f51669e118f3af5ca91026e39664c3 to before 98cf264c9cb0561e4ec305a621e9d58116e44aef98cf264c9cb0561e4ec305a621e9d58116e44aef
52821001bb62b764d73e63812133f199b8fef9eb to before deec9b933ee8496274e4c53217a38f31cb59a27fdeec9b933ee8496274e4c53217a38f31cb59a27f

Description

An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.