PyPI/channels CVE-2020-35681: high 7.4, EPSS 2.66%

Django Channels leakage of session identifiers using legacy AsgiHandler

Action: Upgrade channels to 3.0.3 or later.

pip install channels==3.0.3

Affected

Fixed versions

Sources

• osv: GHSA-v542-8q9x-cffc
• https://nvd.nist.gov/vuln/detail/CVE-2020-35681
• https://github.com/django/channels/commit/e85874d9630474986a6937430eac52db79a2a022
• https://channels.readthedocs.io/en/stable/releases/3.0.3.html
• https://channels.readthedocs.io/en/stable/releases/index.html
• https://github.com/advisories/GHSA-v542-8q9x-cffc
• https://github.com/django/channels
• https://github.com/django/channels/releases
• https://github.com/pypa/advisory-database/tree/main/vulns/channels/PYSEC-2021-113.yaml

CVE-2020-35681 · published 2021-03-19T21:29:02Z · modified 2024-09-13T18:01:43.817869Z · JSON