QID 983180

QID 983180: Python (pip) Security Update for django-basic-auth-ip-whitelist (GHSA-m38j-pmg3-v5x5)

Security update has been released for django-basic-auth-ip-whitelist to fix the vulnerability.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Potential timing attack exists on websites where the basic authentication is used or configured, i.e. `BASIC_AUTH_LOGIN` and `BASIC_AUTH_PASSWORD` is set. Currently the string comparison between configured credentials and the ones provided by users is performed through a character-by-character string comparison. This enables a possibility that attacker may time the time it takes the server to validate different usernames and password, and use this knowledge to work out the valid credentials. This attack is understood not to be realistic over the Internet. However, it may be achieved from within local networks where the website is hosted, e.g. from inside a data centre where a website's server is located.

Sites protected by IP address whitelisting only are unaffected by this vulnerability.

CVSS V3 rated as Low - 2.4 severity.

CVSS V2 rated as Low - 2.1 severity.

Solution

This vulnerability has been fixed on version 0.3.4 of django-basic-auth-ip-whitelist. Update to version 0.3.4 as soon as possible and change basic authentication username and password configured on a Django project using this package.Workaround:
Stop using basic authentication and use the IP whitelisting component only. It can be achieved by not setting `BASIC_AUTH_LOGIN` and `BASIC_AUTH_PASSWORD` in Django project settings.

Vendor References

GHSA-m38j-pmg3-v5x5 - github.com/advisories/GHSA-m38j-pmg3-v5x5

CVEs related to QID 983180

CVE-2020-4071 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-m38j-pmg3-v5x5	django-basic-auth-ip-whitelist		github.com/advisories/GHSA-m38j-pmg3-v5x5

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].