https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:44:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-55500 EUVD-2026-55500 https://cve.radiocsirt.org/vuln/euvd-2026-55500 https://cve.radiocsirt.org/vuln/fkie_cve-2019-13177 <p>verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static string for signatures (i.e., the Django Signing API is misused), which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to calling a security-critical function with an incorrect argument.</p> <p>verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static string for signatures (i.e., the Django Signing API is misused), which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to calling a security-critical function with an incorrect argument.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-13177 https://cve.radiocsirt.org/vuln/ghsa-p3w6-jcg4-52xh <p><strong>Affected:</strong> PyPI: django-rest-registration</p> <p>## Misusing the Django Signer API leads to predictable signatures used in verification emails</p> <p>### Impact The vulnerability is a high severity one. Anyone using Django REST Registration library versions `0.2.*` - `0.4.*` with e-mail verification option (which is recommended, but needs [additional configuration](https://django-rest-registration.readthedocs.io/en/latest/quickstart.html#preferred-configuration)) is affected. In the worst case, the attacker can take over any Django user by resetting his/her password without even receiving the reset password verification link, just by guessing the signature from publicly available data (more detailed description below).</p> <p>### Patches The problem has been patched in version `0.5.0`. All library users should upgrade to version `0.5.0` or higher. The fix will invalidate all previously generated signatures , and in consequence, all verification links in previously sent verification e-mails. Therefore semi-major version `0.5.0` was released instead of version `0.4.6` to mark that incompatibility.</p> <p>### Workarounds The easiest way way is to disable the verification options by using something like the minimal configuration described [here](https://django-rest-registration.readthedocs.io/en/latest/quickstart.html#minimal-configuration). This will unfortunately disable checking whether the given e-mail is valid and make unable to users who registered an account but didn&#39;t verify it before config change.</p> <p>Less harsh way is to temporarily dis…</p> <p><strong>Affected:</strong> PyPI: django-rest-registration</p> <p>## Misusing the Django Signer API leads to predictable signatures used in verification emails</p> <p>### Impact The vulnerability is a high severity one. Anyone using Django REST Registration library versions `0.2.*` - `0.4.*` with e-mail verification option (which is recommended, but needs [additional configuration](https://django-rest-registration.readthedocs.io/en/latest/quickstart.html#preferred-configuration)) is affected. In the worst case, the attacker can take over any Django user by resetting his/her password without even receiving the reset password verification link, just by guessing the signature from publicly available data (more detailed description below).</p> <p>### Patches The problem has been patched in version `0.5.0`. All library users should upgrade to version `0.5.0` or higher. The fix will invalidate all previously generated signatures , and in consequence, all verification links in previously sent verification e-mails. Therefore semi-major version `0.5.0` was released instead of version `0.4.6` to mark that incompatibility.</p> <p>### Workarounds The easiest way way is to disable the verification options by using something like the minimal configuration described [here](https://django-rest-registration.readthedocs.io/en/latest/quickstart.html#minimal-configuration). This will unfortunately disable checking whether the given e-mail is valid and make unable to users who registered an account but didn&#39;t verify it before config change.</p> <p>Less harsh way is to temporarily dis…</p> https://cve.radiocsirt.org/vuln/ghsa-p3w6-jcg4-52xh https://cve.radiocsirt.org/vuln/gsd-2019-13177 gsd-2019-13177 https://cve.radiocsirt.org/vuln/gsd-2019-13177 https://cve.radiocsirt.org/vuln/pysec-2019-20 <p><strong>Affected:</strong> PyPI: django-rest-registration</p> <p>verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static string for signatures (i.e., the Django Signing API is misused), which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to calling a security-critical function with an incorrect argument.</p> <p><strong>Affected:</strong> PyPI: django-rest-registration</p> <p>verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static string for signatures (i.e., the Django Signing API is misused), which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to calling a security-critical function with an incorrect argument.</p> https://cve.radiocsirt.org/vuln/pysec-2019-20