UBUNTU-CVE-2019-19844

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2019-19844
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-19844.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2019-19844
Related
Published
2019-12-18T00:00:00Z
Modified
2019-12-18T00:00:00Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

References

Affected packages

Ubuntu:Pro:14.04:LTS / python-django

Package

Name
python-django
Purl
pkg:deb/ubuntu/python-django@1.6.11-0ubuntu1.3+esm7?arch=src?distro=trusty/esm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.6.11-0ubuntu1.3+esm7

Affected versions

1.*

1.5.4-1ubuntu1
1.6-1
1.6.1-1
1.6.1-2
1.6.1-2ubuntu0.1
1.6.1-2ubuntu0.2
1.6.1-2ubuntu0.3
1.6.1-2ubuntu0.4
1.6.1-2ubuntu0.5
1.6.1-2ubuntu0.6
1.6.1-2ubuntu0.8
1.6.1-2ubuntu0.9
1.6.1-2ubuntu0.10
1.6.1-2ubuntu0.11
1.6.1-2ubuntu0.12
1.6.1-2ubuntu0.13
1.6.1-2ubuntu0.14
1.6.1-2ubuntu0.15
1.6.1-2ubuntu0.16
1.6.11-0ubuntu1
1.6.11-0ubuntu1.1
1.6.11-0ubuntu1.2
1.6.11-0ubuntu1.3
1.6.11-0ubuntu1.3+esm1
1.6.11-0ubuntu1.3+esm2
1.6.11-0ubuntu1.3+esm3
1.6.11-0ubuntu1.3+esm4
1.6.11-0ubuntu1.3+esm5
1.6.11-0ubuntu1.3+esm6

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "python-django-doc": "1.6.11-0ubuntu1.3+esm7",
            "python-django": "1.6.11-0ubuntu1.3+esm7"
        }
    ]
}

Ubuntu:16.04:LTS / python-django

Package

Name
python-django
Purl
pkg:deb/ubuntu/python-django@1.8.7-1ubuntu5.11?arch=src?distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.8.7-1ubuntu5.11

Affected versions

1.*

1.7.9-1ubuntu5
1.8.5-2ubuntu1
1.8.7-1ubuntu1
1.8.7-1ubuntu2
1.8.7-1ubuntu3
1.8.7-1ubuntu4
1.8.7-1ubuntu5
1.8.7-1ubuntu5.1
1.8.7-1ubuntu5.2
1.8.7-1ubuntu5.4
1.8.7-1ubuntu5.5
1.8.7-1ubuntu5.6
1.8.7-1ubuntu5.7
1.8.7-1ubuntu5.8
1.8.7-1ubuntu5.9
1.8.7-1ubuntu5.10

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "python-django-common": "1.8.7-1ubuntu5.11",
            "python-django-doc": "1.8.7-1ubuntu5.11",
            "python-django": "1.8.7-1ubuntu5.11",
            "python3-django": "1.8.7-1ubuntu5.11"
        }
    ]
}

Ubuntu:18.04:LTS / python-django

Package

Name
python-django
Purl
pkg:deb/ubuntu/python-django@1:1.11.11-1ubuntu1.6?arch=src?distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1.11.11-1ubuntu1.6

Affected versions

1:1.*

1:1.11.4-1ubuntu1
1:1.11.6-1ubuntu1
1:1.11.9-1ubuntu1
1:1.11.11-1ubuntu1
1:1.11.11-1ubuntu1.1
1:1.11.11-1ubuntu1.2
1:1.11.11-1ubuntu1.3
1:1.11.11-1ubuntu1.4
1:1.11.11-1ubuntu1.5

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "python-django-common": "1:1.11.11-1ubuntu1.6",
            "python-django-doc": "1:1.11.11-1ubuntu1.6",
            "python-django": "1:1.11.11-1ubuntu1.6",
            "python3-django": "1:1.11.11-1ubuntu1.6"
        }
    ]
}

Ubuntu:20.04:LTS / python-django

Package

Name
python-django
Purl
pkg:deb/ubuntu/python-django@2:2.2.9-2ubuntu1?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2:2.2.9-2ubuntu1

Affected versions

1:1.*

1:1.11.22-1ubuntu1

2:2.*

2:2.2.6-1ubuntu1

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "high",
    "binaries": [
        {
            "python-django-doc": "2:2.2.9-2ubuntu1",
            "python3-django": "2:2.2.9-2ubuntu1"
        }
    ]
}