CVE catalog

CVE-2024-21543

djoser vulnerability

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.55% · Oct 25, 2026

Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandjosersid2.3.3-1fixed
Debiandjoserforky2.3.3-1fixed
Debiandjosertrixie2.3.1-1fixed
Debiandjoserbookworm2.1.0-1+deb12u1fixed
Ubuntudjosernoble2.1.0-1ubuntu0.24.04.1fixed
Ubuntupython3-djosernoble2.1.0-1ubuntu0.24.04.1fixed
Ubuntudjoserpro2.0.1-2vulnerable
Ubuntudjoserpro2.0.3-1vulnerable
Ubuntudjoserpro2.0.3-1ubuntu0.1~esm1fixed
Ubuntudjoser22.042.1.0-1vulnerable
Ubuntudjoser22.042.1.0-1ubuntu0.22.04.1fixed
Ubuntudjoser24.042.1.0-1vulnerable
Ubuntudjoser24.042.1.0-1ubuntu0.24.04.1fixed
Ubuntudjoserpro2.0.1-2vulnerable
Ubuntudjoserpro2.0.3-1vulnerable
Ubuntudjoserpro2.0.3-1ubuntu0.1~esm1fixed
Ubuntudjoser22.042.1.0-1vulnerable
Ubuntudjoser22.042.1.0-1ubuntu0.22.04.1fixed
Ubuntudjoser24.042.1.0-1vulnerable
Ubuntudjoser24.042.1.0-1ubuntu0.24.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandjosersourcesid2.3.1-1not yet assignedNot reported[1089915]
Debiandjosersourceforky2.3.1-1not yet assignedNot reported[1089915]
Debiandjosersourcetrixie2.3.1-1not yet assignedNot reported[1089915]
Debiandjosersourcebookworm2.1.0-1+deb12u1not yet assignedNot reported[1089915]
Ubuntudjoserdebnoble2.1.0-1ubuntu0.24.04.1Not reportedNot reportedNot reported
Ubuntupython3-djoserdebnoble2.1.0-1ubuntu0.24.04.1Not reportedNot reportedNot reported
Ubuntudjoserdebpro2.0.3-1ubuntu0.1~esm1Not reportedUSN-7354-1Not reported
Ubuntudjoserdeb22.042.1.0-1ubuntu0.22.04.1Not reportedUSN-7354-1Not reported
Ubuntudjoserdeb24.042.1.0-1ubuntu0.24.04.1Not reportedUSN-7354-1Not reported
Ubuntudjoserdebpro2.0.3-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2024-21543Not reported
Ubuntudjoserdeb22.042.1.0-1ubuntu0.22.04.1Not reportedUBUNTU-CVE-2024-21543Not reported
Ubuntudjoserdeb24.042.1.0-1ubuntu0.24.04.1Not reportedUBUNTU-CVE-2024-21543Not reported

[Debian bug #1089915]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-djoser]Fixed

    Source package: [djoser]

    Details (2)

    • 2.1.0-1+deb12u1 · all · bookworm

      Fixed · Fixed: 2.1.0-1+deb12u1

      usn · djoser · debian · bookworm; usn · djoser · debian · 12

    • 2.1.0-1+deb12u1 · all · bookworm

      Fixed · Fixed: 2.1.0-1+deb12u1

      usn · djoser · debian · bookworm; usn · djoser · debian · 12

[Debian 13 (Trixie)]

  • [python3-djoser]Fixed

    Source package: [djoser]

    Details (2)

    • 2.3.1-1 · all · trixie

      Fixed · Fixed: 2.3.1-1

      usn · djoser · debian · 13

    • 2.3.1-1 · all · trixie

      Fixed · Fixed: 2.3.1-1

      usn · djoser · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Ubuntu Security Notices (USN)]