CVE-2024-39329 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2024-39329 Interim 1 26 2026-03-05T02:23:29Z current 2024-07-09T23:10:12Z 2026-03-05T02:23:29Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2024-39329 An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2024-July/018995.html E-Mail link for SUSE-SU-2024:2545-1 https://lists.suse.com/pipermail/sle-updates/2024-July/036097.html E-Mail link for SUSE-SU-2024:2577-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OU4KXNSFOQVRSGL2OQCMRA3EFMPZEGEU/ E-Mail link for openSUSE-SU-2024:0251-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE SUSE Linux Enterprise Module for Package Hub 15 SP6 SUSE Linux Enterprise Module for Package Hub 15 SP7 openSUSE Leap 15.5 openSUSE Leap 15.6 openSUSE Tumbleweed libsystemd0-254.24-slfo.1.1_1.1 libudev1-254.24-slfo.1.1_1.1 python-Django python3-Django python3-Django-2.0.7-150000.1.20.1 python310-Django-5.0.7-2.1 python310-Django4-4.2.14-1.1 python311-Django python311-Django-4.2.11-150600.3.3.1 python311-Django-5.0.7-2.1 python311-Django4-4.2.14-1.1 python312-Django-5.0.7-2.1 python312-Django4-4.2.14-1.1 python312-Django6-6.0-1.1 python313-Django6-6.0-1.1 regionServiceClientConfigEC2-5.0.0-slfo.1.1_1.1 systemd-254.24-slfo.1.1_1.1 systemd-coredump-254.24-slfo.1.1_1.1 udev-254.24-slfo.1.1_1.1 libsystemd0-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/baremetal-os-container:latest libudev1-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/baremetal-os-container:latest systemd-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/baremetal-os-container:latest udev-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/baremetal-os-container:latest libsystemd0-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/base-os-container:latest libudev1-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/base-os-container:latest systemd-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/base-os-container:latest udev-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/base-os-container:latest libsystemd0-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/kvm-os-container:latest libudev1-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/kvm-os-container:latest systemd-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/kvm-os-container:latest udev-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/kvm-os-container:latest libsystemd0-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/rt-os-container:latest libudev1-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/rt-os-container:latest systemd-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/rt-os-container:latest udev-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/rt-os-container:latest libsystemd0-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/toolbox:latest libudev1-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/toolbox:latest systemd-254.24-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/toolbox:latest libsystemd0-254.24-slfo.1.1_1.1 as a component of Image SL-Micro libudev1-254.24-slfo.1.1_1.1 as a component of Image SL-Micro systemd-254.24-slfo.1.1_1.1 as a component of Image SL-Micro udev-254.24-slfo.1.1_1.1 as a component of Image SL-Micro libsystemd0-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro libudev1-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro regionServiceClientConfigEC2-5.0.0-slfo.1.1_1.1 as a component of Image SLE-Micro systemd-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro systemd-coredump-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro udev-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro libsystemd0-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-Azure libudev1-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-Azure systemd-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-Azure systemd-coredump-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-Azure udev-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-Azure libsystemd0-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS libudev1-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS regionServiceClientConfigEC2-5.0.0-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS systemd-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS systemd-coredump-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS udev-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS libsystemd0-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-Azure libudev1-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-Azure systemd-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-Azure systemd-coredump-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-Azure udev-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-Azure libsystemd0-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-EC2 libudev1-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-EC2 regionServiceClientConfigEC2-5.0.0-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-EC2 systemd-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-EC2 systemd-coredump-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-EC2 udev-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-EC2 libsystemd0-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-GCE libudev1-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-GCE systemd-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-GCE systemd-coredump-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-GCE udev-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-GCE libsystemd0-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-EC2 libudev1-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-EC2 regionServiceClientConfigEC2-5.0.0-slfo.1.1_1.1 as a component of Image SLE-Micro-EC2 systemd-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-EC2 systemd-coredump-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-EC2 udev-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-EC2 libsystemd0-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-GCE libudev1-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-GCE systemd-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-GCE systemd-coredump-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-GCE udev-254.24-slfo.1.1_1.1 as a component of Image SLE-Micro-GCE python311-Django-4.2.11-150600.3.3.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 python311-Django-4.2.11-150600.3.3.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP7 python3-Django-2.0.7-150000.1.20.1 as a component of openSUSE Leap 15.5 python311-Django-4.2.11-150600.3.3.1 as a component of openSUSE Leap 15.6 python310-Django-5.0.7-2.1 as a component of openSUSE Tumbleweed python310-Django4-4.2.14-1.1 as a component of openSUSE Tumbleweed python311-Django-5.0.7-2.1 as a component of openSUSE Tumbleweed python311-Django4-4.2.14-1.1 as a component of openSUSE Tumbleweed python312-Django-5.0.7-2.1 as a component of openSUSE Tumbleweed python312-Django4-4.2.14-1.1 as a component of openSUSE Tumbleweed python312-Django6-6.0-1.1 as a component of openSUSE Tumbleweed python313-Django6-6.0-1.1 as a component of openSUSE Tumbleweed python311-Django as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 python-Django as a component of SUSE Linux Enterprise Module for Package Hub 15 SP6 python3-Django as a component of openSUSE Leap 15.5 python-Django as a component of openSUSE Leap 15.5 An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate() method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password. CVE-2024-39329 Container suse/sl-micro/6.0/baremetal-os-container:latest:libsystemd0-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/baremetal-os-container:latest:libudev1-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/baremetal-os-container:latest:systemd-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/baremetal-os-container:latest:udev-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/base-os-container:latest:libsystemd0-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/base-os-container:latest:libudev1-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/base-os-container:latest:systemd-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/base-os-container:latest:udev-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/kvm-os-container:latest:libsystemd0-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/kvm-os-container:latest:libudev1-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/kvm-os-container:latest:systemd-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/kvm-os-container:latest:udev-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/rt-os-container:latest:libsystemd0-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/rt-os-container:latest:libudev1-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/rt-os-container:latest:systemd-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/rt-os-container:latest:udev-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/toolbox:latest:libsystemd0-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/toolbox:latest:libudev1-254.24-slfo.1.1_1.1 Container suse/sl-micro/6.0/toolbox:latest:systemd-254.24-slfo.1.1_1.1 Image SL-Micro:libsystemd0-254.24-slfo.1.1_1.1 Image SL-Micro:libudev1-254.24-slfo.1.1_1.1 Image SL-Micro:systemd-254.24-slfo.1.1_1.1 Image SL-Micro:udev-254.24-slfo.1.1_1.1 Image SLE-Micro:libsystemd0-254.24-slfo.1.1_1.1 Image SLE-Micro:libudev1-254.24-slfo.1.1_1.1 Image SLE-Micro:regionServiceClientConfigEC2-5.0.0-slfo.1.1_1.1 Image SLE-Micro:systemd-254.24-slfo.1.1_1.1 Image SLE-Micro:systemd-coredump-254.24-slfo.1.1_1.1 Image SLE-Micro:udev-254.24-slfo.1.1_1.1 Image SLE-Micro-Azure:libsystemd0-254.24-slfo.1.1_1.1 Image SLE-Micro-Azure:libudev1-254.24-slfo.1.1_1.1 Image SLE-Micro-Azure:systemd-254.24-slfo.1.1_1.1 Image SLE-Micro-Azure:systemd-coredump-254.24-slfo.1.1_1.1 Image SLE-Micro-Azure:udev-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS:libsystemd0-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS:libudev1-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS:regionServiceClientConfigEC2-5.0.0-slfo.1.1_1.1 Image SLE-Micro-BYOS:systemd-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS:systemd-coredump-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS:udev-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS-Azure:libsystemd0-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS-Azure:libudev1-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS-Azure:systemd-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS-Azure:systemd-coredump-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS-Azure:udev-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS-EC2:libsystemd0-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS-EC2:libudev1-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS-EC2:regionServiceClientConfigEC2-5.0.0-slfo.1.1_1.1 Image SLE-Micro-BYOS-EC2:systemd-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS-EC2:systemd-coredump-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS-EC2:udev-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS-GCE:libsystemd0-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS-GCE:libudev1-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS-GCE:systemd-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS-GCE:systemd-coredump-254.24-slfo.1.1_1.1 Image SLE-Micro-BYOS-GCE:udev-254.24-slfo.1.1_1.1 Image SLE-Micro-EC2:libsystemd0-254.24-slfo.1.1_1.1 Image SLE-Micro-EC2:libudev1-254.24-slfo.1.1_1.1 Image SLE-Micro-EC2:regionServiceClientConfigEC2-5.0.0-slfo.1.1_1.1 Image SLE-Micro-EC2:systemd-254.24-slfo.1.1_1.1 Image SLE-Micro-EC2:systemd-coredump-254.24-slfo.1.1_1.1 Image SLE-Micro-EC2:udev-254.24-slfo.1.1_1.1 Image SLE-Micro-GCE:libsystemd0-254.24-slfo.1.1_1.1 Image SLE-Micro-GCE:libudev1-254.24-slfo.1.1_1.1 Image SLE-Micro-GCE:systemd-254.24-slfo.1.1_1.1 Image SLE-Micro-GCE:systemd-coredump-254.24-slfo.1.1_1.1 Image SLE-Micro-GCE:udev-254.24-slfo.1.1_1.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:python3-Django-2.0.7-150000.1.20.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 SP7:python311-Django-4.2.11-150600.3.3.1 SUSE Linux Enterprise Module for Package Hub 15 SP6:python311-Django-4.2.11-150600.3.3.1 SUSE Linux Enterprise Module for Package Hub 15 SP7:python311-Django-4.2.11-150600.3.3.1 openSUSE Leap 15.5:python3-Django-2.0.7-150000.1.20.1 openSUSE Leap 15.6:python311-Django-4.2.11-150600.3.3.1 openSUSE Tumbleweed:python310-Django-5.0.7-2.1 openSUSE Tumbleweed:python310-Django4-4.2.14-1.1 openSUSE Tumbleweed:python311-Django-5.0.7-2.1 openSUSE Tumbleweed:python311-Django4-4.2.14-1.1 openSUSE Tumbleweed:python312-Django-5.0.7-2.1 openSUSE Tumbleweed:python312-Django4-4.2.14-1.1 openSUSE Tumbleweed:python312-Django6-6.0-1.1 openSUSE Tumbleweed:python313-Django6-6.0-1.1 moderate 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N