Potential Observable Timing Discrepancy in Wagtail

@@ -28,6 +28,7 @@ Changelog
  * Add caching of image renditions (Tom Dyson, Tim Kamanin)
  * Add documentation for reporting security issues and internationalisation (Matt Westcott)
  * Fields on a custom image model can now be defined as required `blank=False` (Matt Westcott)
+ * Fix: CVE-2020-11037 - avoid potential timing attack on password-protected private pages (Thibaud Colas)
  * Fix: Added ARIA alert role to live search forms in the admin (Casper Timmers)
  * Fix: Reorder login form elements to match expected tab order (Kjartan Sverrisson)
  * Fix: Re-add 'Close Explorer' button on mobile viewports (Sævar Öfjörð Magnússon)

@@ -16,6 +16,14 @@ Report data exports
 Data from reports, form submissions and ModelAdmin can now be exported to both XLSX and CSV format. For ModelAdmin, this is enabled by specifying a ``list_export`` attribute on the ModelAdmin class. This feature was developed by Jacob Topp-Mugglestone and sponsored by `The Motley Fool <https://www.fool.com/>`_.
 
 
+CVE-2020-11037: Potential timing attack on password-protected private pages
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This release addresses a potential timing attack on pages or documents that have been protected with a shared password through Wagtail's "Privacy" controls. This password check is performed through a character-by-character string comparison, and so an attacker who is able to measure the time taken by this check to a high degree of accuracy could potentially use timing differences to gain knowledge of the password. (This is `understood to be feasible on a local network, but not on the public internet <https://groups.google.com/d/msg/django-developers/iAaq0pvHXuA/fpUuwjK3i2wJ>`_.)
+
+Many thanks to Thibaud Colas for reporting this issue.
+
+
 Other features
 ~~~~~~~~~~~~~~
 

@@ -1,4 +1,5 @@
 from django import forms
+from django.utils.crypto import constant_time_compare
 from django.utils.translation import ugettext as _
 from django.utils.translation import ugettext_lazy
 
@@ -13,7 +14,7 @@ def __init__(self, *args, **kwargs):
 
     def clean_password(self):
         data = self.cleaned_data['password']
-        if data != self.restriction.password:
+        if not constant_time_compare(data, self.restriction.password):
             raise forms.ValidationError(_("The password you have entered is not correct. Please try again."))
 
         return data

@@ -1,4 +1,5 @@
 from django import forms
+from django.utils.crypto import constant_time_compare
 from django.utils.translation import ugettext as _
 from django.utils.translation import ugettext_lazy
 
@@ -13,7 +14,7 @@ def __init__(self, *args, **kwargs):
 
     def clean_password(self):
         data = self.cleaned_data['password']
-        if data != self.restriction.password:
+        if not constant_time_compare(data, self.restriction.password):
             raise forms.ValidationError(_("The password you have entered is not correct. Please try again."))
 
         return data

@@ -1,4 +1,5 @@
 from django import forms
+from django.utils.crypto import constant_time_compare
 from django.utils.translation import gettext as _
 from django.utils.translation import gettext_lazy
 
@@ -13,7 +14,7 @@ def __init__(self, *args, **kwargs):
 
     def clean_password(self):
         data = self.cleaned_data['password']
-        if data != self.restriction.password:
+        if not constant_time_compare(data, self.restriction.password):
             raise forms.ValidationError(_("The password you have entered is not correct. Please try again."))
 
         return data