Input validation error in Django - CVE-2019-19844

Vulnerability identifier: #VU23667

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-19844

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to hijack another user account.

The vulnerability exists due to insufficient validation of user-supplied input when processing email addresses passed via the password reset form. A remote attacker with knowledge of a valid email address can use a specially crafted email that after Unicode transformation will be treated as the victim's email address and reset password for the victim's account to the attacker provided email address.

Django
Gentoo Linux
Fedora
Ubuntu
py-django (Alpine package)
python-django (Ubuntu package)
python-django (Debian package)
py3-django (Alpine package)
python-django

Install updates from vendor's website.

Django - addressed in versions 1.11.27, 2.2.9, 3.0.1
py-django (Alpine package) - update to 1.11.27-r0
python-django (Ubuntu package) - addressed in versions Ubuntu Pro, 1.8.7-1ubuntu5.11, 1:1.11.11-1ubuntu1.6, 1:1.11.20-1ubuntu0.3, 1:1.11.22-1ubuntu1.1
python-django (Debian package) - addressed in versions 1:1.10.7-2+deb9u7, 1:1.11.27-1~deb10u1
py3-django (Alpine package) - update to 1.11.27-r0
python-django - addressed in versions 1.11.27-1.el7, 2.2.9-1.el8, 2.2.9-1.fc31

• Exploit #5818 - Django < 3.0 < 2.2 < 1.11 - Account Hijack (June 17, 2021)

• https://www.djangoproject.com/weblog/2019/dec/18/security-releases/

• Arbitrary account hijacking in Django
• Ubuntu update for Django
• Debian update for python-django
• Gentoo update for Django
• Input validation error in py-django (Alpine package)
• Input validation error in py3-django (Alpine package)
• Ubuntu update for python-django
• Fedora 31 update for python-django
• Fedora EPEL 7 update for python-django
• Fedora EPEL 8 update for python-django