PT-2019-20172 · Django · Django-Rest-Registration

Publicado 2019-07-02 · Atualizado 2019-07-02

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions django-rest-registration versions prior to 0.5.0

Description The issue arises from the misuse of the Django Signing API in the verification.py file, where a static string is used for signatures. This allows remote attackers to spoof the verification process due to incorrect code refactoring, which led to a security-critical function being called with an incorrect argument.

Recommendations For versions prior to 0.5.0, update to version 0.5.0 or later to resolve the issue. As a temporary workaround, consider reviewing and correcting the usage of the Django Signing API in the verification.py file to prevent the misuse of static strings for signatures.

Identificadores relacionados

PYSEC-2019-90

Produtos afetados

Django-Rest-Registration

Referências · 3

• https://github.com/apragacz/django-rest-registration/security/advisories/GHSA-p3w6-jcg4-52xh · Nota
• https://github.com/apragacz/django-rest-registration/releases/tag/0.5.0 · Nota
• https://osv.dev/vulnerability/PYSEC-2019-90 · Aviso do Fabricante