CVE-2020-4071

In django-basic-auth-ip-whitelist before 0.3.4, a potential timing attack exists on websites where the basic authentication is used or configured, i.e. BASIC_AUTH_LOGIN and BASIC_AUTH_PASSWORD is set. Currently the string comparison between configured credentials and the ones provided by users is performed through a character-by-character string comparison. This enables a possibility that attacker may time the time it takes the server to validate different usernames and password, and use this knowledge to work out the valid credentials. This attack is understood not to be realistic over the Internet. However, it may be achieved from within local networks where the website is hosted, e.g. from inside a data centre where a website's server is located. Sites protected by IP address whitelisting only are unaffected by this vulnerability. This vulnerability has been fixed on version 0.3.4 of django-basic-auth-ip-whitelist. Update to version 0.3.4 as soon as possible and change basic authentication username and password configured on a Django project using this package. A workaround without upgrading to version 0.3.4 is to stop using basic authentication and use the IP whitelisting component only. It can be achieved by not setting BASIC_AUTH_LOGIN and BASIC_AUTH_PASSWORD in Django project settings.

• CWE-208

• https://github.com/tm-kn/django-basic-auth-ip-whitelist/security/advisories/GHSA-m38j-pmg3-v5x5Third Party Advisory
• https://groups.google.com/forum/#%21msg/django-developers/iAaq0pvHXuA/fpUuwjK3i2wJ
• https://github.com/tm-kn/django-basic-auth-ip-whitelist/security/advisories/GHSA-m38j-pmg3-v5x5Third Party Advisory
• https://groups.google.com/forum/#%21msg/django-developers/iAaq0pvHXuA/fpUuwjK3i2wJ

Published

Jun 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-4061In October from version 1.0.319 and before version 1.0.467, …5.4
• CVE-2020-4062In Conjur OSS Helm Chart before 2.0.0, a recently identified…9
• CVE-2020-4066In Limdu before 0.95, the trainBatch function has a command …7.2
• CVE-2020-4067In coturn before version 4.5.1.3, there is an issue whereby …7.5
• CVE-2020-4068In APNSwift 1.0.0, calling APNSwiftSigner.sign(digest:) is l…9.8
• CVE-2020-4070In CSS Validator less than or equal to commit 54d68a1, there…5.4
• CVE-2020-4072In generator-jhipster-kotlin version 1.6.0 log entries are c…5.3
• CVE-2020-4074In PrestaShop from version 1.5.0.0 and before version 1.7.6.…9.8
• CVE-2020-4075In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, …7.5
• CVE-2020-4076In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, …9
• CVE-2020-4077In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, …9.9
• CVE-2020-4079Combodo iTop is a web based IT Service Management tool. In i…7.7