USN-7354-1: djoser vulnerability

USN-7354-1: djoser vulnerability
17 March 2025

djoser could be made to bypass authentication checks during login.

Releases
Ubuntu 24.10 Ubuntu 24.04 LTS Ubuntu 22.04 LTS Ubuntu 20.04 LTS
Packages
djoser - REST implementation of Django authentication system
Details
Diego Cebrián discovered that djoser did not properly handle user
authentication. An attacker with valid credentials could possibly
use this to bypass authentication checks, such as two-factor
authentication, to gain unintended access.

Update instructions
The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.10

• python3-djoser - 2.1.0-1ubuntu0.24.10.1
  Ubuntu 24.04
• python3-djoser - 2.1.0-1ubuntu0.24.04.1
  Ubuntu 22.04
• python3-djoser - 2.1.0-1ubuntu0.22.04.1
  Ubuntu 20.04
• python3-djoser - 2.0.3-1ubuntu0.1~esm1
  In general, a standard system update will make all the necessary changes.