Headline
CVE-2023-42820: perf: 修复随机 error · jumpserver/jumpserver@42337f0
JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local authentication are also not affected. Users are advised to upgrade to either version 2.28.19 or to 3.6.5. There are no known workarounds or this issue.
@@ -1,30 +1,27 @@
#!/usr/bin/env python
# -*- coding: utf-8 -*-
import uuid
import base64
import string
import random
import datetime
import uuid
from typing import Callable
from django.db import models
from django.conf import settings
from django.utils import timezone
from django.core.cache import cache
from django.contrib.auth.models import AbstractUser
from django.contrib.auth.hashers import check_password
from django.utils.translation import ugettext_lazy as _
from django.contrib.auth.models import AbstractUser
from django.core.cache import cache
from django.db import models
from django.shortcuts import reverse
from django.utils import timezone
from django.utils.module_loading import import_string
from django.utils.translation import ugettext_lazy as _
from orgs.utils import current_org
from orgs.models import Organization
from rbac.const import Scope
from common.db import fields, models as jms_models
from common.utils import (
date_expired_default, get_logger, lazyproperty, random_string, bulk_create_with_signal
)
from orgs.utils import current_org
from rbac.const import Scope
from …signals import post_user_change_password, post_user_leave_org, pre_user_leave_org
__all__ = ['User’, ‘UserPasswordHistory’]
Expand Down Expand Up
@@ -518,8 +515,7 @@ def access_key(self):
return self.access_keys.first()
def generate_reset_token(self):
letter = string.ascii_letters + string.digits
token = '’.join([random.choice(letter) for _ in range(50)])
token = random_string(50)
self.set_cache(token)
return token
Expand Down