CVE-2019-13177 Improper Verification of Cryptographic Signature in django-rest-registration
Remote attackers can spoof the verification process in Django REST Registration due to misuse of the Django Signing API with static signatures.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-13177?
CVE-2019-13177 is a critical vulnerability in n/a, published on 2 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static string for signatures (i.e., the Django Signing API is misused), which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to calling a security-critical function with an incorrect argument.
Weakness: CWE-347
Which versions are affected by CVE-2019-13177?
3 open source packages ship an affected version, including django-rest-registration. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
django-rest-registration PyPI | All versions | 0.5.0 |
django-rest-registration PyPI | From 0.2.0 | 0.5.0 |
django-rest-registration PyPI | From 0.2.0 | 0.5.0 |
Products include Django-Rest-Registration Project Django-Rest-Registration.
How do I fix CVE-2019-13177?
Upgrade django-rest-registration to 0.5.0 or later.
Is CVE-2019-13177 being exploited?
There is no known exploitation of CVE-2019-13177 in the wild and no public exploit code.
Sources
Also known as GHSA-p3w6-jcg4-52xh, PYSEC-2019-20.