TI-2023-16362 Aliases CVE-2023-33185 GHSA-qg36-9jxh-fj25

Incorrect signature verification in django-ses

MEDIUM 58CWE-347Published 2023-05-26 · Updated 2025-01-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests are signed by AWS and are verified by django_ses, however the verification of this signature was found to be flawed as it allowed users to specify arbitrary public certificates. This issue was patched in version 3.5.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00233 14th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed django-ses (django-ses): 3.5.0django-ses (PyPI): 3.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
django-ses	django-ses	before 3.5.0	3.5.0	Patch available	CNA
—	django-ses (PyPI)	before 3.5.0	3.5.0	Patch available	GHSA-qg36-9jxh-fj25

django-ses Vendordjango-ses Affected before 3.5.0 Fixed in 3.5.0 Patch available CNA
django-ses (PyPI) Vendor— Affected before 3.5.0 Fixed in 3.5.0 Patch available GHSA-qg36-9jxh-fj25

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:django-ses_project:django-ses::::::::	before 3.5.0	Vulnerable	Django-ses Project

cpe:2.3:a:django-ses_project:django-ses:*:*:*:*:*:*:*:* Versions before 3.5.0 Vulnerable ·Django-ses Project

Remediation

Fix · CNA django-ses (django-ses) Fixed in 3.5.0
Fix · GHSA-qg36-9jxh-fj25 django-ses (PyPI) Fixed in 3.5.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-33185
2026-10-03 Alias added: GHSA-qg36-9jxh-fj25

References

Exploit 1

https://github.com/django-ses/django-ses/blob/3d627067935876487f9938310d5e1fbb249a7778/CVE/001-cert-url-signature-verification.md

Patch 1

https://github.com/django-ses/django-ses/commit/b71b5f413293a13997b6e6314086cb9c22629795

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences