social-auth-app-django affected by Improper Handling of Case Sensitivity
Date: 2024-04
Affected: pip/social-auth-app-django
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-32879
CWE: CWE-178
CWE-303
CVSS: 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)

### Impact Due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. ### Patches This issue has been addressed by https://github.com/python-social-auth/social-app-django/pull/566 and fix released in 5.4.1. ### Workarounds An immediate workaround would be to change collation of the affected field: ```mysql ALTER TABLE `social_auth_usersocialauth` MODIFY `uid` varchar(255) COLLATE `utf8_bin`; ``` ### References This issue was discovered by folks at https://opencraft.com/.


Mitigations:

Architectural layers (MAESTRO):