Skip to content
OpenAdvisories
Medium · 4.9 CVE-2024-32879 EUVD-2024-1061GHSA-2gr8-3wc7-xhj3PYSEC-2026-1931

social-auth-app-django Improper Handling of Case Sensitivity vulnerability

Published Apr 24, 2024 · Updated Aug 2, 2024 · Assigned by GitHub_M

Vendor: python-social-auth Product: social-app-django Package: python-social-auth Package: social-auth-app-django Package: social-auth-app-django Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu

Description

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed by a fix released in version 5.4.1. An immediate workaround would be to change collation of the affected field.

Affected products

VendorProductAffectedFixed
python-social-auth social-app-django < 5.4.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 social-auth-app-django 5.4.1-1 —
Debian 13 social-auth-app-django 5.4.1-1 —
Debian 12 social-auth-app-django No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS python-social-auth No fix yet —
Ubuntu 16.04 LTS python-social-auth No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Ansible Automation Platform Inside 2 python-black +1 22.8.0-2.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 python-cryptography +1 42.0.5-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 python-jinja2 +1 3.1.4-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 python-zipp +1 3.19.2-1.el9ap RHSA-2024:6428
Red Hat Ansible Automation Platform Inside 2 python39-black +1 22.8.0-2.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 python39-cryptography +1 42.0.5-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 python39-jinja2 +1 3.1.4-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Inside 2 python39-zipp 3.19.2-1.el8ap RHSA-2024:6428
Red Hat Ansible Automation Platform Inside 2 receptor +1 1.4.8-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 automation-controller +1 4.5.10-1.el8ap RHSA-2024:6428
Red Hat Ansible Automation Platform Developer 2 python-black +1 22.8.0-2.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python-cryptography +1 42.0.5-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python-idna +1 3.7-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python-jinja2 +1 3.1.4-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python-requests +1 2.32.2-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python-zipp +1 3.19.2-1.el9ap RHSA-2024:6428
Red Hat Ansible Automation Platform Developer 2 python39-black +1 22.8.0-2.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python39-cryptography +1 42.0.5-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python39-idna +1 3.7-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python39-jinja2 +1 3.1.4-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python39-requests +1 2.32.2-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform Developer 2 python39-zipp 3.19.2-1.el8ap RHSA-2024:6428
Red Hat Ansible Automation Platform Developer 2 receptor +1 1.4.8-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 automation-controller +3 4.5.10-1.el8ap RHSA-2024:6428
Red Hat Ansible Automation Platform 2 automation-controller-venv-tower 4.5.7-1.el8ap RHSA-2024:6428, RHSA-2024:3781
Red Hat Ansible Automation Platform 2 automation-hub +2 4.9.2-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-aiohttp +1 3.9.5-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-black +1 22.8.0-2.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-cryptography +1 42.0.5-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-django +1 4.2.15-1.el9ap RHSA-2024:6428
Red Hat Ansible Automation Platform 2 python-galaxy-ng +1 4.9.2-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-grpcio +1 1.58.3-1.el9ap RHSA-2024:6428
Red Hat Ansible Automation Platform 2 python-gunicorn +1 22.0.0-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-idna +1 3.7-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-jinja2 +1 3.1.4-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-pillow +1 10.3.0-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-pydantic +1 1.10.15-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-requests +1 2.32.2-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-social-auth-app-django +1 5.4.1-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-sqlparse +1 0.5.0-1.el9ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python-zipp +1 3.19.2-1.el9ap RHSA-2024:6428
Red Hat Ansible Automation Platform 2 python39-aiohttp +1 3.9.5-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-black +1 22.8.0-2.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-cryptography +1 42.0.5-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-django +1 4.2.15-1.el8ap RHSA-2024:6428
Red Hat Ansible Automation Platform 2 python39-grpcio +1 1.58.3-1.el8ap RHSA-2024:6428
Red Hat Ansible Automation Platform 2 python39-gunicorn +1 22.0.0-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-idna +1 3.7-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-jinja2 +1 3.1.4-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-pillow +1 10.3.0-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-pydantic +1 1.10.15-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-requests +1 2.32.2-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-social-auth-app-django +1 5.4.1-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-sqlparse +1 0.5.0-1.el8ap RHSA-2024:3781
Red Hat Ansible Automation Platform 2 python39-zipp 3.19.2-1.el8ap RHSA-2024:6428
Red Hat Ansible Automation Platform 2 receptor +1 1.4.8-1.el8ap RHSA-2024:3781

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed python-social-auth-app-django 5.4.1-1.1 openSUSE-SU-2026:12043-1, openSUSE-SU-2024:14036-1

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI social-auth-app-django < 5.4.1 5.4.1 GHSA-2gr8-3wc7-xhj3

Advisories 5

References