CVE-2023-33185 (Python, published 2023-05-26T21:15Z)
Description: value: Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests are signed by AWS and are verified by django_ses, however the verification of this signature was found to be flawed as it allowed users to specify arbitrary public certificates. This issue was patched in version 3.5.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/django-ses/django-ses
Files changed:
django_ses/utils.py
Commit message: Restrict amazonaws allowed certificate URLs.


Vulnerable code:

from django_ses.deprecation import RemovedInDjangoSES20Warning

from urllib.error import URLError
        msg_type = self._data.get('Type')
        if msg_type == 'Notification':
                'Message',
                'MessageId',
                'Subject',
                'Timestamp',
                'TopicArn',
                'Type',
        elif (msg_type == 'SubscriptionConfirmation' or
              msg_type == 'UnsubscribeConfirmation'):
                'Message',
                'MessageId',
                'SubscribeURL',
                'Timestamp',
                'Token',
                'TopicArn',
                'Type',
        'utils.BounceMessageVerifier is deprecated. It is renamed to EventMessageVerifier.',
    if 'bounce_dict' in kwargs:
        kwargs['notification'] = kwargs['bounce_dict']
        del kwargs['bounce_dict']
        'utils.verify_bounce_message is deprecated. It is renamed to verify_event_message.',
        'Received subscription confirmation: TopicArn: %s',
        notification.get('TopicArn'),
            'notification': notification,
    subscribe_url = notification.get('SubscribeURL')
            'Could not confirm subscription: "%s"', e,
                'notification': notification,

Fixed code:
import re
from urllib.error import URLError

from django_ses.deprecation import RemovedInDjangoSES20Warning
SES_REGEX_CERT_URL = re.compile(
    "(?i)^https://sns\.[a-z0-9\-]+\.amazonaws\.com(\.cn)?/SimpleNotificationService\-[a-z0-9]+\.pem$"
)

            if "amazonaws.com" in trusted_domain:
                if not SES_REGEX_CERT_URL.match(cert_url):
                    if len(parts) < 4:
                        return None
                    else:
                        logger.warning('Possible security risk for: "%s"', cert_url)
                        logger.warning(
                            "It is strongly recommended to configure the full domain in EVENT_CERT_DOMAINS. "
                            "See v3.5.0 release notes for more details."
                        )

        msg_type = self._data.get("Type")
        if msg_type == "Notification":
                "Message",
                "MessageId",
                "Subject",
                "Timestamp",
                "TopicArn",
                "Type",
        elif (
            msg_type == "SubscriptionConfirmation"
            or msg_type == "UnsubscribeConfirmation"
        ):
                "Message",
                "MessageId",
                "SubscribeURL",
                "Timestamp",
                "Token",
                "TopicArn",
                "Type",
        "utils.BounceMessageVerifier is deprecated. It is renamed to EventMessageVerifier.",
    if "bounce_dict" in kwargs:
        kwargs["notification"] = kwargs["bounce_dict"]
        del kwargs["bounce_dict"]
        "utils.verify_bounce_message is deprecated. It is renamed to verify_event_message.",
        "Received subscription confirmation: TopicArn: %s",
        notification.get("TopicArn"),
            "notification": notification,
    subscribe_url = notification.get("SubscribeURL")
            'Could not confirm subscription: "%s"',
            e,
                "notification": notification,