« Volver al listado

CVE-2024-32879

Estado: AplazadaMedia (4.9)—

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed by a fix released in version 5.4.1. An immediate workaround would be to change collation of the affected field.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Mariadb — MariadbAIMysql — MysqlAIPython Social Auth — Python Social AuthAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-32879",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32879",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-04-29T19:27:52.308869Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "python-social-auth",
          "product": "social-app-django",
          "versions": [
            {
              "status": "affected",
              "version": "< 5.4.1"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:python-social-auth:social-app-django:*:*:*:*:*:*:*:*"
          ],
          "vendor": "python-social-auth",
          "product": "social-app-django",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "5.4.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-04-24T20:15:07.867",
  "references": [
    {
      "url": "https://github.com/python-social-auth/social-app-django/commit/31c3e0c7edb187004d8abbde7e9c4f7ef9098138",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/python-social-auth/social-app-django/pull/566",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-2gr8-3wc7-xhj3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/python-social-auth/social-app-django/commit/31c3e0c7edb187004d8abbde7e9c4f7ef9098138",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/python-social-auth/social-app-django/pull/566",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-2gr8-3wc7-xhj3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-178"
        },
        {
          "lang": "en",
          "value": "CWE-303"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed by a fix released in version 5.4.1. An immediate workaround would be to change collation of the affected field."
    },
    {
      "lang": "es",
      "value": "Python Social Auth es un mecanismo de autenticación/registro social. Antes de la versión 5.4.1, debido a la intercalación predeterminada que no distingue entre mayúsculas y minúsculas en las bases de datos MySQL o MariaDB, los ID de usuario de autenticación de terceros no distinguen entre mayúsculas y minúsculas y podrían hacer que coincidan diferentes ID. Este problema se solucionó mediante una solución publicada en la versión 5.4.1. Un workaround inmediata sería cambiar la clasificación del campo afectado."
    }
  ],
  "lastModified": "2026-06-17T07:30:36.413",
  "sourceIdentifier": "security-advisories@github.com"
}