mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-31 09:41:08 +00:00
Code Issues 32 Releases Wiki Activity

Fixed CVE-2019-19844 -- Used verified user email for password reset requests.

Browse Source 
Co-Authored-By: Florian Apolloner <florian@apolloner.eu>
This commit is contained in:
Simon Charette
2019-12-16 21:51:57 -05:00
committed by Mariusz Felisiak
parent f4647179cc
commit 5b1fbcef7a
5 changed files with 110 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
docs/releases/2.2.9.txt
View File

@@ -2,9 +2,25 @@
Django 2.2.9 release notes
==========================
*Expected January 2, 2020*
*December 18, 2019*
Django 2.2.9 fixes a data loss bug in 2.2.8.
Django 2.2.9 fixes a security issue and a data loss bug in 2.2.8.
CVE-2019-19844: Potential account hijack via password reset form
================================================================
By submitting a suitably crafted email address making use of Unicode
characters, that compared equal to an existing user email when lower-cased for
comparison, an attacker could be sent a password reset token for the matched
account.
In order to avoid this vulnerability, password reset requests now compare the
submitted email using the stricter, recommended algorithm for case-insensitive
comparison of two identifiers from `Unicode Technical Report 36, section
2.11.2(B)(2)`__. Upon a match, the email containing the reset token will be
sent to the email address on record rather than the submitted address.
.. __: https://www.unicode.org/reports/tr36/#Recommendations_General
Bugfixes
========