CVE-2024-21543

Name	CVE-2024-21543
Description	Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1089915

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
djoser (PTS)	stretch	0.5.2-1	vulnerable
	buster	1.4.0-1	vulnerable
	sid, trixie, bullseye, bookworm	2.1.0-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
djoser	source	stretch	(unfixed)	end-of-life
djoser	source	buster	(unfixed)	end-of-life
djoser	source	(unstable)	(unfixed)		1089915

Notes

https://github.com/sunscrapers/djoser/issues/795
https://github.com/sunscrapers/djoser/pull/819
https://github.com/sunscrapers/djoser/commit/d33c3993c0c735f23cbedc60fa59fce69354f19d (2.3.0)