CVE-2023-33185
Medium
Description
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests are signed by AWS and are verified by django_ses, however the verification of this signature was found to be flawed as it allowed users to specify arbitrary public certificates. This issue was patched in version 3.5.0.
SeverityMedium
CVSS4.6
Exploit probability—
ProductDjango-ses
PublishedMay 26, 2023
First seenMay 26, 2023
Weakness typeCWE-347CWE-347
How to fix
Update
- django-ses_project django-ses3.5.0 or later
- django-ses3.5.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| django-ses_project django-ses | v < 3.5.0 | 3.5.0 |
| django-sesPyPI | v < 3.5.0 | 3.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.