CVE-2019-19844 Django Potential account hijack via password reset form
Attackers can take over user accounts by exploiting Unicode case transformations in email addresses during password reset requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-19844?
CVE-2019-19844 is a critical authentication bypass vulnerability in Canonical Ubuntu Linux, published on 18 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)
Weakness: CWE-640
Which versions are affected by CVE-2019-19844?
7 open source packages ship an affected version, including django and Django. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
django PyPI | All versions | 1.11.27, 2.2.9 |
django PyPI | All versions | 1.11.27 |
django PyPI | From 2.0 | 2.2.9 |
django PyPI | From 3.0 | 3.0.1 |
Django PyPI | All versions | 1.11.27 |
Django PyPI | From 2.0 | 2.2.9 |
1 more packages
Django PyPI | From 3.0 | 3.0.1 |
Linux distribution packages (2)
python-django-allauth openSUSE:Tumbleweed | All versions | 0.63.3-1.1 |
python-django-allauth openSUSE:Tumbleweed | All versions | 65.19.1-1.1 |
Products include Canonical Ubuntu Linux, Djangoproject Django.
How do I fix CVE-2019-19844?
Upgrade django to a fixed version for your release line: 1.11.27, 2.2.9 or 3.0.1.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-19844 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-19844 exists.
Public exploit code: 1 Exploit-DB entry and 3 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2019-19844, DEBIAN-CVE-2019-19844, DLA-2042-1, DSA-4598-1, GHSA-vfq6-hq5r-27r6, PYSEC-2019-16 and 6 more.