Re: CVE Request: Django: Account enumeration through timing attack in password verification in django.contrib.auth

[Salvatore Bonaccorso <carnil () debian org>]

Hi

On Mon, Jul 22, 2013 at 05:04:44PM +0200, Salvatore Bonaccorso wrote:
> Hi
>
> Cc'ing security () djangoproject com
>
> From [1] in Django accounts can be enumerated trough timing attacks:
>
> > When attempting to authenticate using django.contrib.auth, if a user does not
> > exist the authenticate() function returns None nearly instantaneously, while
> > when a user exists it takes much longer as the attempted password gets hashed
> > and compared with the stored password. This allows for an attacker to infer
> > whether or not a given account exists based upon the response time of an
> > authentication attempt.  This can be seen much more clearly when the number of
> > rounds on the password hasher is set to something high like 100000.
>
>  [1] https://code.djangoproject.com/ticket/20760
>
> A proposed patch is at [2] but not yet a commit in upstream git repository.
>
>  [2] https://code.djangoproject.com/attachment/ticket/20760/20760_fix_hash_once.diff
>
> Does this needs a CVE asignment?

Only a update: this was now fixed in [1] in master branch, and in [2]
as backport for 1.6.x.

 [1] https://github.com/django/django/commit/5dbca13f3baa2e1bafd77e84a80ad6d8a074712e
 [2] https://github.com/django/django/commit/4525eab0779a2946063288224dcebb61ba382976

Regards,
Salvatore