CVE-2023-33185

Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests are signed by AWS and are verified by django_ses, however the verification of this signature was found to be flawed as it allowed users to specify arbitrary public certificates. This issue was patched in version 3.5.0.

• CWE-347
• CWE-347

• https://github.com/django-ses/django-ses/blob/3d627067935876487f9938310d5e1fbb249a7778/CVE/001-cert-url-signature-verification.mdExploit, Third Party Advisory
• https://github.com/django-ses/django-ses/commit/b71b5f413293a13997b6e6314086cb9c22629795Patch
• https://github.com/django-ses/django-ses/security/advisories/GHSA-qg36-9jxh-fj25Vendor Advisory
• https://github.com/django-ses/django-ses/blob/3d627067935876487f9938310d5e1fbb249a7778/CVE/001-cert-url-signature-verification.mdExploit, Third Party Advisory
• https://github.com/django-ses/django-ses/commit/b71b5f413293a13997b6e6314086cb9c22629795Patch
• https://github.com/django-ses/django-ses/security/advisories/GHSA-qg36-9jxh-fj25Vendor Advisory

Published

May 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3318A vulnerability was found in SourceCodester Resort Managemen…5.4
• CVE-2023-33180Xibo is a content management system (CMS). An SQL injection …6.5
• CVE-2023-33181Xibo is a content management system (CMS). Starting in versi…5.3
• CVE-2023-33182Contacts app for Nextcloud easily syncs contacts from variou…4.3
• CVE-2023-33183Calendar app for Nextcloud easily sync events from various d…4.3
• CVE-2023-33184Nextcloud Mail is a mail app in Nextcloud. A blind SSRF atta…5.3
• CVE-2023-33186Zulip is an open-source team collaboration tool with unique …6.1
• CVE-2023-33187Highlight is an open source, full-stack monitoring platform.…6.5
• CVE-2023-33188Omni-notes is an open source note-taking application for And…5.5
• CVE-2023-33189Pomerium is an identity and context-aware access proxy. With…9.8
• CVE-2023-3319Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2023-33190Sealos is an open source cloud operating system distribution…9.8