SB2020010811 - Debian update for python-django
Published: January 8, 2020
Security Bulletin ID
SB2020010811
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Input validation error (CVE-ID: CVE-2019-19844)
The vulnerability allows a remote attacker to hijack another user account.
The vulnerability exists due to insufficient validation of user-supplied input when processing email addresses passed via the password reset form. A remote attacker with knowledge of a valid email address can use a specially crafted email that after Unicode transformation will be treated as the victim's email address and reset password for the victim's account to the attacker provided email address.
Remediation
Install update from vendor's website.