Stay Secure with the Latest Linux Advisories

security advisorycriticaldebian

Debian: DSA-4598-1 Critical: Django Account Hijack Threat

Simon Charette reported that the password reset functionality in Django, a high-level Python web development framework, uses a Unicode case-insensitive query to retrieve accounts matching the email address requesting the password reset. An attacker can take advantage of this . - ------------------------------------------------------------------------- Debian Security Advisory DSA-4598-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Salvatore Bonaccorso January 07, 2020 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : python-django CVE ID : CVE-2019-19844 Debian Bug : 946937 Simon Charette reported that the password reset functionality in Django, a high-level Python web development framework, uses a Unicode case-insensitive query to retrieve accounts matching the email address requesting the password reset. An attacker can take advantage of this flaw to potentially retrieve password reset tokens and hijack accounts. For details please refer to https://www.djangoproject.com/weblog/2019/dec/18/security-releases/ For the oldstable distribution (stretch), this problem has been fixed in version 1:1.10.7-2+deb9u7. For the stable distribution (buster), this problem has been fixed in version 1:1.11.27-1~deb10u1. We recommend that you upgrade your python-django packages. For the detailed security status of python-django please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/python-django Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Update the python-django framework to address a significant vulnerability in the password recovery process, ensuring protection against unauthorized account access.. python django security,debian advisory DSA-4598-1, account recovery exploit. . Severity: Critical. LinuxSecurity.com Team

Jan 07, 2020 •Critical Debian