CVE-2023-33185

描述

Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests are signed by AWS and are verified by django_ses, however the verification of this signature was found to be flawed as it allowed users to specify arbitrary public certificates. This issue was patched in version 3.5.0.

如何修補 CVE-2023-33185

要修補 CVE-2023-33185,請將受影響套件升級到下列已修補版本。

• —升級至 3.5.0 或更新版本
• —升級至 b71b5f413293a13997b6e6314086cb9c22629795 或更新版本

CVE-2023-33185 正在被利用嗎?

低 — EPSS 為 0.1%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 3.5.0
• from 0, < b71b5f413293a13997b6e6314086cb9c22629795 | from 0, < 3.5.0

CVSS 分數

參考連結(6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-33185
• PATCHgithub.com/django-ses/django-ses
• WEBgithub.com/django-ses/django-ses/blob/3d627067935876487f9938310d5e1fbb249a7778/CVE/001-cert-url-signature-verification.md
• WEBgithub.com/django-ses/django-ses/commit/b71b5f413293a13997b6e6314086cb9c22629795