PT-2023-24202 · Unknown · Django-Ses

Josephsurin · Publicado 2023-05-22 · Atualizado 2023-06-06 · CVE-2023-33185

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Média

Vetor base

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Django-SES versions prior to 3.5.0

Description The django ses library, a mail backend for Django using AWS Simple Email Service, has a flaw in the verification of signed requests from AWS. The SESEventWebhookView class is intended to handle email bounces, subscriptions, etc., but the verification of the signature allowed users to specify arbitrary public certificates.

Recommendations For versions prior to 3.5.0, update to version 3.5.0 to resolve the issue. As a temporary workaround, consider restricting access to the SESEventWebhookView class until the update is applied.

Exploit

Correção

Improper Verification of Cryptographic Signature

Enumeração de Fraquezas

CWE-347

Identificadores relacionados

CVE-2023-33185

GHSA-QG36-9JXH-FJ25

PYSEC-2023-82

Produtos afetados

Django-Ses

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33185.json · Exploit
• 🔥 https://github.com/django-ses/django-ses/blob/3d627067935876487f9938310d5e1fbb249a7778/CVE/001-cert-url-signature-verification.md · Exploit
• https://github.com/django-ses/django-ses/security/advisories/GHSA-qg36-9jxh-fj25 · Aviso do Fabricante
• https://github.com/django-ses/django-ses/commit/b71b5f413293a13997b6e6314086cb9c22629795 · Correção
• https://github.com/django-ses/django-ses · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/django-ses/PYSEC-2023-82.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-33185 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2023-82 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-qg36-9jxh-fj25 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-33185 · Aviso do Fabricante