Arch Linux Security Advisory ASA-201810-5

Severity: Medium
Date : 2018-10-01
CVE-ID : CVE-2018-16984
Package : python-django
Type : information disclosure
Remote : Yes
Link : https://security.archlinux.org/AVG-773

Summary

The package python-django before version 2.1.2-1 is vulnerable to
information disclosure.

Resolution

Upgrade to 2.1.2-1.

pacman -Syu “python-django>=2.1.2-1”

The problem has been fixed upstream in version 2.1.2.

Workaround

None.

Description

If an admin user has the change permission to the user model, only part
of the password hash is displayed in the change form. Admin users with
the view (but not change) permission to the user model were displayed
the entire hash. While it’s typically infeasible to reverse a strong
password hash, if your site uses weaker password hashing algorithms
such as MD5 or SHA1, it could be a problem.

Impact

A remote authenticated administrator with change permissions is able to
obtain the password hashes of users.

References

https://www.djangoproject.com/weblog/2018/oct/01/security-release/
https://github.com/django/django/commit/c4bd5b597e0aa2432e4c867b86650f18af117851
https://security.archlinux.org/CVE-2018-16984