GitHub Advisoryadvisory · PyPI
GHSA-37cf-r3w2-gjfw django-nopassword stores secrets in cleartext
HIGH
Official page ↗
- Aliases
- CVE-2019-10682
- Ecosystem
- PyPI
- Packages
- django-nopassword
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-312, CWE-522
- Reviewed
- 2020-06-04
Affected packages
• PyPI django-nopassword: < 5.0.0 → fixed in 5.0.0
Description
django-nopassword before 5.0.0 stores cleartext secrets in the database.
Related
Alias · CVE (1)
- CVE-2019-10682 django-nopassword before 5.0.0 stores cleartext secrets in the database. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10682 advisory
- https://github.com/relekang/django-nopassword/commit/d8b4615f5fbfe3997d96cf4cb3e342406396193c web
- https://github.com/advisories/GHSA-37cf-r3w2-gjfw advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/django-nopassword/PYSEC-2020-229.yaml web
- https://github.com/relekang/django-nopassword package
- https://github.com/relekang/django-nopassword/blob/8e8cfc765ee00adfed120c2c79bf71ef856e9022/nopassword/models.py#L14 web
- https://github.com/relekang/django-nopassword/compare/v4.0.1...v5.0.0 web