CVE-2019-19844

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2019-19844 python-django 修正版: 2:2.2.9-1

参照URL

advisory docs.djangoproject.com
advisory security.gentoo.org
advisory security.netapp.com
advisory usn.ubuntu.com
advisory debian.org
advisory djangoproject.com
web packetstormsecurity.com
web groups.google.com
web lists.fedoraproject.org
web seclists.org