Update dependency djoser to v2.3.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
djoser	2.1.0 → 2.3.0

---

djoser Authentication Bypass

CVE-2024-21543 / GHSA-v49p-m6gh-747c

More information

Details

Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-21543
• https://github.com/sunscrapers/djoser/issues/795
• https://github.com/sunscrapers/djoser/pull/819
• https://github.com/sunscrapers/djoser/commit/d33c3993c0c735f23cbedc60fa59fce69354f19d
• https://github.com/sunscrapers/djoser/releases/tag/2.3.0
• https://security.snyk.io/vuln/SNYK-PYTHON-DJOSER-8366540
• https://github.com/pypa/advisory-database/tree/main/vulns/djoser/PYSEC-2024-158.yaml
• https://lists.debian.org/debian-lts-announce/2025/02/msg00023.html
• https://github.com/advisories/GHSA-v49p-m6gh-747c

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

sunscrapers/djoser (djoser)

v2.3.0

Compare Source

• a potentially breaking change: fix vuln where users were given tokens if the given password was correct, but they haven't passed Django internal AUTHENTICATION_BACKENDS #​795

v2.2.3

Compare Source

• add support for protocol, domain and site name customization in the email contents #​781
• remove unused inactive_account serializer error, not in use since Django 1.10 https://redirect.github.com/sunscrapers/djoser/pull/806/commits/b02c422151035a2616102fbb9b48af28067f9c5d
• add catalan translations, update spanish translations #​826
• move serializers for TokenDestroyView and SignupRequestView to class level, so the OpenAPI schema can be automatically generated #​817
• fixed typo SingupRequestView -> SignupRequestView #​817

v2.2.2

Compare Source

• fix regression: rollback path changes as it resulted in regressions for some #​778
• add Django 5 to test suite pipeline - consider it being supported #​772
• fix in docs 641b824

v2.2.1

Compare Source

• add Indonesian translations #​718
• add Django 4.2 support #​741
• fix: return 204 instead of 400 if no user found #​721
• minor change/fix in a few translations https://redirect.github.com/sunscrapers/djoser/pull/654/files https://redirect.github.com/sunscrapers/djoser/pull/746/files
• minor change in the user activation template https://redirect.github.com/sunscrapers/djoser/pull/731/files

v2.2.0

Compare Source

• add WebAuthn support
• add translations: Japanese, German, Brazilian
• add support for Django 3 and 4, drop support for Django 2
• drop support for Python 3.7
• use safe urls in templates
• renamed ID_FIELD to USER_ID_FIELD

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.