Bug 2314496 (CVE-2024-45231)

Summary: CVE-2024-45231 python-django: Potential user email enumeration via response status on password reset
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: apevec, bbuckingham, brking, eglynn, ehelms, ggainey, gpathan, gtanzill, haoli, hkataria, jcammara, jjoyce, jmitchel, jneedle, jschluet, juwatts, kshier, lhh, lsvaty, mabashia, mburns, mgarciac, mhulan, mminar, nmoumoul, pbraun, pcreech, pgrist, rbiba, rchan, rhos-maint, simaishi, smcdonal, sskracic, stcannon, teagle, tfister, thavo, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Python's Django package. This flaw allows an attacker to enumerate users' emails by issuing password reset requests.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2024-09-24 20:01:01 UTC 
Due to unhandled email sending failures, the django.contrib.auth.forms.PasswordResetForm class allowed remote attackers to enumerate user emails by issuing password reset requests and observing the outcomes.

To mitigate this risk, exceptions occurring during password reset email sending are now handled and logged using the django.contrib.auth logger.