Critical Account Takeover Vulnerability in Python-Django Package
Summary
UBUNTU-CVE-2019-19844: Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. Affects python-django versions < 1.6.11-0ubuntu1.3+esm7. Fixed in 1.6.11-0ubuntu1.3+esm7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Python-Django is a high-level Python web framework that encourages rapid development and clean, pragmatic design. It is widely used for building web applications due to its simplicity and flexibility. However, certain versions of Python-Django are vulnerable to an account takeover issue, which can have severe implications for user security.
Vulnerability Detail
Django versions prior to 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 are susceptible to an account takeover vulnerability. This issue arises when a crafted email address matches an existing user's email address after case transformation of Unicode characters, allowing an attacker to receive a password reset token for that user. This vulnerability can lead to unauthorized access to user accounts, compromising sensitive information and user privacy.
How To Fix
Minimum fixed version
1.6.11-0ubuntu1.3+esm7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-djangoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is recommended to implement additional checks on email addresses during the password reset process to prevent unauthorized access. This can include sending password reset tokens only to the registered user email address.
Conclusion
The account takeover vulnerability in Python-Django poses a significant risk to user security. It is crucial to update to the latest patched versions of the package to mitigate this risk. Additionally, implementing temporary workarounds can help protect user accounts until the update is applied.
See every vulnerability recorded for python-django →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
Affected versions include Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized access to user accounts, allowing attackers to compromise sensitive information and user privacy.
Yes, Vulert can monitor and alert in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for python-django.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
