From 90f297d90f83ab28959143b7c7bbefb39f3fcd8c Mon Sep 17 00:00:00 2001 From: Mohamed ElKalioby Date: Mon, 10 Oct 2022 17:46:03 +0300 Subject: [PATCH] Fixing CVE-2022-42731 for v2.5 --- CHANGELOG.md | 2 +- mfa/FIDO2.py | 2 +- setup.py | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0c11061..2b0a3a6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,5 @@ # Change Log -## 2.5.1 +## 2.5.2 * Fix: CVE-2022-42731: related to possibility of registration replay attack thanks to 'SSE (Secure Systems Engineering)' ## 2.5.0 diff --git a/mfa/FIDO2.py b/mfa/FIDO2.py index a2b5b5b..f5bf858 100644 --- a/mfa/FIDO2.py +++ b/mfa/FIDO2.py @@ -57,7 +57,7 @@ def complete_reg(request): att_obj = AttestationObject((data['attestationObject'])) server = getServer() auth_data = server.register_complete( - request.session.pop['fido_state'], + request.session.pop('fido_state'), client_data, att_obj ) diff --git a/setup.py b/setup.py index 02d4a7b..e2e6be6 100644 --- a/setup.py +++ b/setup.py @@ -4,7 +4,7 @@ from setuptools import find_packages, setup setup( name='django-mfa2', - version='2.5.1', + version='2.5.2', description='Allows user to add 2FA to their accounts', long_description=open("README.md").read(), long_description_content_type="text/markdown",