CVE-2023-22451 (published 2023-01-02T16:15Z)

Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by providing defaults for the `AUTH_PASSWORD_VALIDATORS` configuration setting. As of version 11.7, the password can’t be too similar to other personal information, must contain at least 10 characters, can’t be a commonly used password, and can’t be entirely numeric. As a workaround, an administrator may reset all passwords in Kiwi TCMS if they think a weak password may have been chosen.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-521
cwe_name: Weak Password Requirements
description: The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
extended_description: Authentication mechanisms often rely on a memorized secret (also known as a password) to provide an assertion of identity for a user of a system. It is therefore important that this password be of sufficient complexity and impractical for an adversary to guess. The specific requirements around how complex a password needs to be depends on the type of system being protected. Selecting the correct password requirements and enforcing them through implementation are critical to the overall success of the authentication mechanism.
         

Fix information:
repo_url: https://github.com/kiwitcms/Kiwi
commit_details: repo_url: https://github.com/kiwitcms/Kiwi
author: Alexander Todorov
author_date: 2023-01-01 13:03:53+02:00
msg: Update tests to use a stronger password
repository: repo_url: https://github.com/kiwitcms/Kiwi
repo_name: kiwitcms/Kiwi
description: open source test management system with over 2 million downloads!
repo_language: Python
owner: kiwitcms
file_changes: filename: __init__.py
change_type: ModificationType.MODIFY
diff: @@ -0,0 +1 @@
+__FOR_TESTING__ = "5a5b6e17f9c34025a75b052fc06c50ab"

programming_language: SQL
filename: test_admin.py
change_type: ModificationType.MODIFY
diff: @@ -11,6 +11,8 @@ from tcms.kiwi_auth.admin import Group
 from tcms.tests import LoggedInTestCase, user_should_have_perm
 from tcms.tests.factories import GroupFactory, UserFactory
 
+from . import __FOR_TESTING__
+
 
 class TestUserAdmin(LoggedInTestCase):  # pylint: disable=too-many-public-methods
     @classmethod
@@ -65,8 +67,8 @@ class TestUserAdmin(LoggedInTestCase):  # pylint: disable=too-many-public-method
             "/admin/auth/user/add/",
             {
                 "username": "added-by-admin",
-                "password1": "xo-xo-xo",
-                "password2": "xo-xo-xo",
+                "password1": __FOR_TESTING__,
+                "password2": __FOR_TESTING__,
             },
             follow=True,
         )
@@ -225,8 +227,8 @@ class TestUserAdmin(LoggedInTestCase):  # pylint: disable=too-many-public-method
             "/admin/auth/user/add/",
             {
                 "username": "added-by-moderator",
-                "password1": "xo-xo-xo",
-                "password2": "xo-xo-xo",
+                "password1": __FOR_TESTING__,
+                "password2": __FOR_TESTING__,
             },
             follow=True,
         )
@@ -373,8 +375,8 @@ class TestUserAdmin(LoggedInTestCase):  # pylint: disable=too-many-public-method
             "/admin/auth/user/add/",
             {
                 "username": "added-by-regular-user",
-                "password1": "xo-xo-xo",
-                "password2": "xo-xo-xo",
+                "password1": __FOR_TESTING__,
+                "password2": __FOR_TESTING__,
             },
             follow=True,
         )

programming_language: Python
filename: test_forms.py
change_type: ModificationType.MODIFY
diff: @@ -5,13 +5,15 @@ from django.utils.translation import gettext_lazy as _
 
 from tcms.kiwi_auth import forms
 
+from . import __FOR_TESTING__
+
 
 class TestCaptchaField(TestCase):
     def setUp(self):
         self.data = {
             "username": "test_user",
-            "password1": "password",
-            "password2": "password",
+            "password1": __FOR_TESTING__,
+            "password2": __FOR_TESTING__,
             "email": "new-tester@example.com",
         }
 
@@ -49,8 +51,8 @@ class TestRegistrationForm(TestCase):
     def setUp(self):
         self.data = {
             "username": "test_user",
-            "password1": "password",
-            "password2": "password",
+            "password1": __FOR_TESTING__,
+            "password2": __FOR_TESTING__,
             "email": "new-tester@example.com",
         }
 

programming_language: Python
filename: test_views.py
change_type: ModificationType.MODIFY
diff: @@ -17,6 +17,8 @@ from tcms.kiwi_auth import forms
 from tcms.kiwi_auth.models import UserActivationKey
 from tcms.tests.factories import UserFactory
 
+from . import __FOR_TESTING__
+
 User = get_user_model()  # pylint: disable=invalid-name
 
 
@@ -117,8 +119,8 @@ class TestRegistration(TestCase):
                     self.register_url,
                     {
                         "username": username,
-                        "password1": "password",
-                        "password2": "password",
+                        "password1": __FOR_TESTING__,
+                        "password2": __FOR_TESTING__,
                         "email": "new-tester@example.com",
                         "captcha_0": "PASSED",
                         "captcha_1": "PASSED",
@@ -254,8 +256,8 @@ To activate your account, click this link:
             self.register_url,
             {
                 "username": "kiwi-tester",
-                "password1": "password-1",
-                "password2": "password-2",
+                "password1": __FOR_TESTING__,
+                "password2": f"000-{__FOR_TESTING__}",
                 "email": "new-tester@example.com",
             },
             follow=False,
@@ -272,8 +274,8 @@ To activate your account, click this link:
             self.register_url,
             {
                 "username": "test_user",
-                "password1": "password",
-                "password2": "password",
+                "password1": __FOR_TESTING__,
+                "password2": __FOR_TESTING__,
                 "email": "new-tester@example.com",
             },
             follow=False,

programming_language: Python