CVE catalog

CVE-2019-19844

python-django: CVE-2019-19844

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
53.56% · Oct 25, 2026

Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-djangosid3:5.2.18-1fixed
Debianpython-djangoforky3:5.2.17-2fixed
Debianpython-djangotrixie3:4.2.28-0+deb13u2fixed
Debianpython-djangotrixie-security3:4.2.28-0+deb13u1fixed
Debianpython-djangobookworm3:3.2.25-0+deb12u3fixed
Debianpython-djangobookworm-security3:3.2.25-0+deb12u6fixed
Alpinepy-django3.101.11.27-r0fixed
Alpinepy-django3.81.11.27-r0fixed
Alpinepy-django3.91.11.27-r0fixed
Alpinepy3-django3.111.11.27-r0fixed
Alpinepy3-django3.121.11.27-r0fixed
Opensusepython-django-allauthtumbleweed65.19.1-1.1fixed
Ubuntupython-djangopro1.5.4-1ubuntu1vulnerable
Ubuntupython-djangopro1.6-1vulnerable
Ubuntupython-djangopro1.6.1-1vulnerable
Ubuntupython-djangopro1.6.1-2vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.1vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.2vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.3vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.4vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.5vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.6vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.8vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.9vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.10vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.11vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.12vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.13vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.14vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.15vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.16vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.1vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.2vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.3vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.3+esm1vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.3+esm2vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.3+esm3vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.3+esm4vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.3+esm5vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.3+esm6vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.3+esm7fixed
Ubuntupython-django16.041.7.9-1ubuntu5vulnerable
Ubuntupython-django16.041.8.5-2ubuntu1vulnerable
Ubuntupython-django16.041.8.7-1ubuntu1vulnerable
Ubuntupython-django16.041.8.7-1ubuntu2vulnerable
Ubuntupython-django16.041.8.7-1ubuntu3vulnerable
Ubuntupython-django16.041.8.7-1ubuntu4vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.1vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.2vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.4vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.5vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.6vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.7vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.8vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.9vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.10vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.11fixed
Ubuntupython-django18.041:1.11.4-1ubuntu1vulnerable
Ubuntupython-django18.041:1.11.6-1ubuntu1vulnerable
Ubuntupython-django18.041:1.11.9-1ubuntu1vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.1vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.2vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.3vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.4vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.5vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.6fixed
Opensusepython-django-allauthtumbleweed0.63.3-1.1fixed
Ubuntupython-djangopro1.5.4-1ubuntu1vulnerable
Ubuntupython-djangopro1.6-1vulnerable
Ubuntupython-djangopro1.6.1-1vulnerable
Ubuntupython-djangopro1.6.1-2vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.1vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.2vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.3vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.4vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.5vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.6vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.8vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.9vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.10vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.11vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.12vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.13vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.14vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.15vulnerable
Ubuntupython-djangopro1.6.1-2ubuntu0.16vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.1vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.2vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.3vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.3+esm1vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.3+esm2vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.3+esm3vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.3+esm4vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.3+esm5vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.3+esm6vulnerable
Ubuntupython-djangopro1.6.11-0ubuntu1.3+esm7fixed
Ubuntupython-django16.041.7.9-1ubuntu5vulnerable
Ubuntupython-django16.041.8.5-2ubuntu1vulnerable
Ubuntupython-django16.041.8.7-1ubuntu1vulnerable
Ubuntupython-django16.041.8.7-1ubuntu2vulnerable
Ubuntupython-django16.041.8.7-1ubuntu3vulnerable
Ubuntupython-django16.041.8.7-1ubuntu4vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.1vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.2vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.4vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.5vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.6vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.7vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.8vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.9vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.10vulnerable
Ubuntupython-django16.041.8.7-1ubuntu5.11fixed
Ubuntupython-django18.041:1.11.4-1ubuntu1vulnerable
Ubuntupython-django18.041:1.11.6-1ubuntu1vulnerable
Ubuntupython-django18.041:1.11.9-1ubuntu1vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.1vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.2vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.3vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.4vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.5vulnerable
Ubuntupython-django18.041:1.11.11-1ubuntu1.6fixed
Ubuntupython-django20.041:1.11.22-1ubuntu1vulnerable
Ubuntupython-django20.042:2.2.6-1ubuntu1vulnerable
Ubuntupython-django20.042:2.2.9-2ubuntu1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-djangosourcesid2:2.2.9-1not yet assignedNot reported[946937]
Debianpython-djangosourceforky2:2.2.9-1not yet assignedNot reported[946937]
Debianpython-djangosourcetrixie2:2.2.9-1not yet assignedNot reported[946937]
Debianpython-djangosourcebookworm2:2.2.9-1not yet assignedNot reported[946937]
Alpinepy-djangoapk3.101.11.27-r0Not reportedALPINE-CVE-2019-19844Not reported
Alpinepy-djangoapk3.81.11.27-r0Not reportedALPINE-CVE-2019-19844Not reported
Alpinepy-djangoapk3.91.11.27-r0Not reportedALPINE-CVE-2019-19844Not reported
Alpinepy3-djangoapk3.111.11.27-r0Not reportedALPINE-CVE-2019-19844Not reported
Alpinepy3-djangoapk3.121.11.27-r0Not reportedALPINE-CVE-2019-19844Not reported
Opensusepython-django-allauthrpmtumbleweed65.19.1-1.1Not reportedOPENSUSE-SU-2026:11570-1Not reported
Ubuntupython-djangodebpro1.6.11-0ubuntu1.3+esm7Not reportedUSN-6722-1Not reported
Ubuntupython-djangodeb16.041.8.7-1ubuntu5.11Not reportedUSN-4224-1Not reported
Ubuntupython-djangodeb18.041:1.11.11-1ubuntu1.6Not reportedUSN-4224-1Not reported
Opensusepython-django-allauthrpmtumbleweed0.63.3-1.1Not reportedOPENSUSE-SU-2024:14065-1Not reported
Ubuntupython-djangodebpro1.6.11-0ubuntu1.3+esm7Not reportedUBUNTU-CVE-2019-19844Not reported
Ubuntupython-djangodeb16.041.8.7-1ubuntu5.11Not reportedUBUNTU-CVE-2019-19844Not reported
Ubuntupython-djangodeb18.041:1.11.11-1ubuntu1.6Not reportedUBUNTU-CVE-2019-19844Not reported
Ubuntupython-djangodeb20.042:2.2.9-2ubuntu1Not reportedUBUNTU-CVE-2019-19844Not reported

[Debian bug #946937]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • Source package: [python-django]

    Details (6)
    • 3:3.2.25-0+deb12u3 · all · bookworm

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:3.2.25-0+deb12u3 · all · bookworm

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:4.2.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:4.2.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:3.2.25-0+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:3.2.25-0+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

  • Source package: [python-django]

    Details (6)
    • 3:3.2.25-0+deb12u3 · all · bookworm

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:3.2.25-0+deb12u3 · all · bookworm

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:4.2.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:4.2.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:3.2.25-0+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

    • 3:3.2.25-0+deb12u4 · all · bookworm-security

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · bookworm; dsa · python-django · debian · 12

[Debian 13 (Trixie)]

  • Source package: [python-django]

    Details (6)
    • 3:4.2.28-0+deb13u2 · all · trixie

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · 13

    • 3:4.2.28-0+deb13u2 · all · trixie

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · 13

    • 3:5.2.16-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · 13

    • 3:5.2.16-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · 13

    • 3:4.2.28-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · 13

    • 3:4.2.28-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · 13

  • Source package: [python-django]

    Details (6)
    • 3:4.2.28-0+deb13u2 · all · trixie

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · 13

    • 3:4.2.28-0+deb13u2 · all · trixie

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · 13

    • 3:5.2.16-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · 13

    • 3:5.2.16-1~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · 13

    • 3:4.2.28-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · 13

    • 3:4.2.28-0+deb13u1 · all · trixie-security

      Fixed · Fixed: 2:2.2.9-1

      dsa · python-django · debian · 13

[openSUSE Tumbleweed]

Observed:

References