Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6722-1 advisory.

    Simon Charette discovered that the password reset functionality in Django used a Unicode case insensitive     query to retrieve accounts associated with an email address. An attacker could possibly use this to obtain     password reset tokens and hijack accounts.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202004-17 (Django: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Django. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by sending specially crafted input, could possibly       cause a Denial of Service condition, or alter the database.
  Workaround :

    There is no known workaround at this time.

fix CVE-2019-19844 (rhbz#1788426)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Simon Charette reported that the password reset functionality in Django, a high-level Python web development framework, uses a Unicode case-insensitive query to retrieve accounts matching the email address requesting the password reset. An attacker can take advantage of this flaw to potentially retrieve password reset tokens and hijack accounts.

For details please refer to https://www.djangoproject.com/weblog/2019/dec/18/security-releases/

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4224-1 advisory.

    Simon Charette discovered that the password reset functionality in Django used a Unicode case insensitive     query to retrieve accounts associated with an email address. An attacker could possibly use this to obtain     password reset tokens and hijack accounts.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that there was a potential account hijack vulnerabilility in Django, the Python-based web development framework.

Django's password-reset form used a case-insensitive query to retrieve accounts matching the email address requesting the password reset.
Because this typically involves explicit or implicit case transformations, an attacker who knew the email address associated with a user account could craft an email address which is distinct from the address associated with that account, but which -- due to the behavior of Unicode case transformations -- ceases to be distinct after case transformation, or which will otherwise compare equal given database case-transformation or collation behavior. In such a situation, the attacker can receive a valid password-reset token for the user account.

To resolve this, two changes were made in Django :

  - After retrieving a list of potentially-matching accounts     from the database, Django's password reset functionality     now also checks the email address for equivalence in     Python, using the recommended identifier-comparison     process from Unicode Technical Report 36, section     2.11.2(B)(2).

  - When generating password-reset emails, Django now sends     to the email address retrieved from the database, rather     than the email address submitted in the password-reset     request form.

For more information, please see :

https://www.djangoproject.com/weblog/2019/dec/18/security-releases/

For Debian 8 'Jessie', this issue has been fixed in python-django version 1.7.11-1+deb8u8.

We recommend that you upgrade your python-django packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
192975	Ubuntu 14.04 LTS : Django vulnerability (USN-6722-1)	Nessus	Ubuntu Local Security Checks	critical
136216	GLSA-202004-17 : Django: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
133016	Fedora 31 : python-django (2020-adb4f0143a)	Nessus	Fedora Local Security Checks	critical
132699	Debian DSA-4598-1 : python-django - security update	Nessus	Debian Local Security Checks	critical
132310	Ubuntu 16.04 LTS / 18.04 LTS : Django vulnerability (USN-4224-1)	Nessus	Ubuntu Local Security Checks	critical
132268	Debian DLA-2042-1 : python-django security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2019-19844

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical