GHSA-qg36-9jxh-fj25

Source

https://github.com/advisories/GHSA-qg36-9jxh-fj25

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-qg36-9jxh-fj25/GHSA-qg36-9jxh-fj25.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qg36-9jxh-fj25

Aliases

Published

2023-05-22T19:41:56Z

Modified

2026-09-10T03:50:08Z

Severity

4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Incorrect signature verification in django-ses

Details

The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the SESEventWebhookView class intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests are signed by AWS and are verified by django_ses, however the verification of this signature was found to be flawed as it allowed users to specify arbitrary public certificates.

Database specific

{
    "cwe_ids":  [
        "CWE-347"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-05-22T19:41:56Z",
    "nvd_published_at":  "2023-05-26T21:15:20Z",
    "severity":  "LOW"
}

References

Affected packages

PyPI / django-ses

Package

Name: django-ses; View open source insights on deps.dev
Purl: pkg:pypi/django-ses

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.5.0

Affected versions

0.*

0.1

0.2

0.3.0

0.4.0

0.4.1

0.6.0

0.7.0

0.7.1

0.8.0

0.8.1

0.8.2

0.8.3

0.8.3.1

0.8.4

0.8.5

0.8.6

0.8.7

0.8.8

0.8.9

0.8.10

0.8.11

0.8.12

0.8.13

0.8.14

1.*

1.0.0

1.0.1

1.0.2

1.0.3

2.*

2.0.0

2.1.0

2.1.1

2.2.0

2.2.1

2.2.2

2.3.0

2.3.1

2.4.0

2.5.0

2.6.0

2.6.1

3.*

3.0.0

3.0.1

3.1.0

3.1.2

3.2.0

3.2.1

3.2.2

3.3.0

3.4.0

3.4.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-qg36-9jxh-fj25/GHSA-qg36-9jxh-fj25.json"