CVE-2019-19844

Description

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

How to fix CVE-2019-19844

To remediate CVE-2019-19844, upgrade the affected package to a fixed version below.

• —upgrade to 1.11.27-r0 or later
• —upgrade to 1.11.27-r0 or later
• —upgrade to 1:1.10.7-2+deb9u7 or later
• —upgrade to 1.7.11-1+deb8u8 or later
• —upgrade to 2:2.2.9-1 or later
• —upgrade to 1.11.27 or later
• —upgrade to 1.11.27 or later

Is CVE-2019-19844 being exploited?

Moderate — EPSS is 15.4%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (7)

• from 0, < 1.11.27-r0
• from 0, < 1.11.27-r0
• from 0, < 1:1.10.7-2+deb9u7
• from 0, < 1.7.11-1+deb8u8
• from 0, < 2:2.2.9-1
• from 0, < 1.11.27
• from 0, < 1.11.27, >= 2.2, < 2.2.9

CVSS scores

References (25)

• ADVISORYgithub.com/advisories/GHSA-vfq6-hq5r-27r6
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2019-19844
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2019-19844
• ADVISORYsecurity.netapp.com/advisory/ntap-20200110-0003/
• ADVISORY