Lucene search
Veracode Vulnerability DatabaseVERACODE:40750HistoryJun 01, 2023 - 4:31 a.m.
Signature Validation Bypass
2023-06-0104:31:45
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
9
signature validation
bypass
aws certificates
vulnerability
django_ses
0.001 Low
EPSS
Percentile
29.1%
django_ses is vulnerable to Signature Validation Bypass. The vulnerability exists in utils.py due to a lack of validation in AWS certificates because an attacker can specify arbitrary public certificates.
| CPE | Name | Operator | Version |
|---|---|---|---|
| django-ses | le | 1.0.3 | |
| django-ses | le | 2.6.1 | |
| django-ses | le | 3.4.1 | |
| django-ses | le | 1.0.3 | |
| django-ses | le | 2.6.1 | |
| django-ses | le | 3.4.1 |
References
github.com/advisories/GHSA-qg36-9jxh-fj25
github.com/django-ses/django-ses/blob/3d627067935876487f9938310d5e1fbb249a7778/CVE/001-cert-url-signature-verification.md
github.com/django-ses/django-ses/commit/b71b5f413293a13997b6e6314086cb9c22629795
github.com/django-ses/django-ses/security/advisories/GHSA-qg36-9jxh-fj25
Related
prion
prion
Code injection
2023-05-26 21:15:00
github
github
Incorrect signature verification in django-ses
2023-05-22 19:41:56
osv
osv
Incorrect signature verification in django-ses
2023-05-22 19:41:56
CVE-2023-33185
2023-05-26 21:15:20
PYSEC-2023-82
2023-05-26 21:15:00
cve
cve
CVE-2023-33185
2023-05-26 21:15:20
cvelist
cvelist
CVE-2023-33185 Incorrect signature verification in django-ses
2023-05-26 20:03:33
nvd
nvd
CVE-2023-33185
2023-05-26 21:15:20