Critical, CVSS 9.3PyPIAmendedPublished
Improper Verification of Cryptographic Signature in django-rest-registration
CVE-2019-13177 · GHSA-p3w6-jcg4-52xh
- Affected
- PyPI django-rest-registration >= 0.2.0, < 0.5.0
- Fixed in
- 0.5.0· Vendor fix available
- Issue
- Misusing the Django Signer API leads to predictable signatures used in verification emails Impact The vulnerability is a high severity one. Anyone using Django REST Registration library versions 0.2. - 0.4. with e-mail verification option (which is recommended, but needs additional configuration) is affected. In the worst case, the attacker can take over any Django user by resetting his/her password without even receiving the reset password verification link, just by guessing the signature from publicly available data (more detailed description below). Patches The problem has been patched in version 0.5.0. All library users should upgrade to version 0.5.0 or higher. The fix will invalidate all previously generated signatures , and in consequence, all verification links in previously sent verification e-mails. Therefore semi-major version 0.5.0 was released instead of version 0.4.6 to mark that incompatibility. Workarounds The easiest way way is to disable the verification options by…
Recommended action: Upgrade to 0.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.