USN-4224-1: Django vulnerability
19 December 2019
Django accounts could be hijacked through password reset requests.
- python-django - High-level Python web development framework
Simon Charette discovered that the password reset functionality in
Django used a Unicode case insensitive query to retrieve accounts
associated with an email address. An attacker could possibly use this
to obtain password reset tokens and hijack accounts.
The problem can be corrected by updating your system to the following package versions:
In general, a standard system update will make all the necessary changes.