CVE - CVE-2016-2513

CVE-ID
CVE-2016-2513	Learn more at National Vulnerability Database (NVD) • Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings
Description
The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/django/django/commit/67b46ba7016da2d259c1ecc7d666d11f5e1cfaab CONFIRM:https://www.djangoproject.com/weblog/2016/mar/01/security-releases/ CONFIRM:http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html DEBIAN:DSA-3544 URL:http://www.debian.org/security/2016/dsa-3544 REDHAT:RHSA-2016:0504 URL:http://rhn.redhat.com/errata/RHSA-2016-0504.html REDHAT:RHSA-2016:0502 URL:http://rhn.redhat.com/errata/RHSA-2016-0502.html REDHAT:RHSA-2016:0505 URL:http://rhn.redhat.com/errata/RHSA-2016-0505.html REDHAT:RHSA-2016:0506 URL:http://rhn.redhat.com/errata/RHSA-2016-0506.html UBUNTU:USN-2915-1 URL:http://www.ubuntu.com/usn/USN-2915-1 UBUNTU:USN-2915-2 URL:http://www.ubuntu.com/usn/USN-2915-2 UBUNTU:USN-2915-3 URL:http://www.ubuntu.com/usn/USN-2915-3 BID:83878 URL:http://www.securityfocus.com/bid/83878 SECTRACK:1035152 URL:http://www.securitytracker.com/id/1035152
Assigning CNA
N/A
Date Entry Created
20160219	Disclaimer: The entry creation date may reflect when the CVE-ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20160219)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE list, which standardizes names for security problems.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org