{
  "cveId": "CVE-2024-21543",
  "url": "https://patchblox.com/security/cve/CVE-2024-21543",
  "summary": "CVE-2024-21543 is fixed in 2 products on 1 platform, first by python3-djoser 2.0.3-1ubuntu0.1~esm1, released December 12, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "python3-djoser: Versions of the package djoser before 2.3.0 are vulnerable toAuthentication Bypass when the authenticate() function f...",
  "description": "Versions of the package djoser before 2.3.0 are vulnerable toAuthentication Bypass when the authenticate() function fails. This isbecause the system falls back to querying the database directly, grantingaccess to users with valid credentials, and eventually bypassing customauthentication checks such as two-factor authentication, LDAP validations,or requirements from configured AUTHENTICATION_BACKENDS.",
  "published": "2024-12-12T21:15:00Z",
  "severity": "Medium",
  "epss": 0.00546,
  "epssPercentile": 0.46059,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "djoser",
      "release": "Debian 11.6 (bullseye)",
      "fixedVersion": "2.1.0-1\u002Bdeb11u1",
      "fix": "DLA-4060-1",
      "url": "https://patchblox.com/security/fix/linux/dla-4060-1",
      "released": "2025-02-20T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "djoser",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2.1.0-1\u002Bdeb12u1",
      "fix": "DEBIAN-CVE-2024-21543",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-21543",
      "released": "2024-12-13T05:15:07Z"
    },
    {
      "platform": "linux",
      "product": "djoser",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.3.1-1",
      "fix": "DEBIAN-CVE-2024-21543",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-21543",
      "released": "2024-12-13T05:15:07Z"
    },
    {
      "platform": "linux",
      "product": "djoser",
      "release": "Debian 14",
      "fixedVersion": "2.3.1-1",
      "fix": "DEBIAN-CVE-2024-21543",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-21543",
      "released": "2024-12-13T05:15:07Z"
    },
    {
      "platform": "linux",
      "product": "python3-djoser",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2.0.3-1ubuntu0.1~esm1",
      "fix": "python3-djoser 2.0.3-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-python3-djoser-2.0.3-1ubuntu0.1-esm1",
      "released": "2024-12-12T21:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-djoser",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.1.0-1ubuntu0.22.04.1",
      "fix": "python3-djoser 2.1.0-1ubuntu0.22.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-python3-djoser-2.1.0-1ubuntu0.22.04.1",
      "released": "2024-12-12T21:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-djoser",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2.1.0-1ubuntu0.24.04.1",
      "fix": "python3-djoser 2.1.0-1ubuntu0.24.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-python3-djoser-2.1.0-1ubuntu0.24.04.1",
      "released": "2024-12-12T21:15:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-djoser",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "2.1.0-1ubuntu0.24.10.1",
      "fix": "python3-djoser 2.1.0-1ubuntu0.24.10.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-python3-djoser-2.1.0-1ubuntu0.24.10.1",
      "released": "2026-01-16T01:42:23Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}