PyPI/django-basic-auth-ip-whitelist CVE-2020-4071: unknown, EPSS 0.36%
In django-basic-auth-ip-whitelist before 0.3.4, a potential timing attack exists on websites where the basic authentication is used or configured, i.e. BASIC_AUTH_LOGIN and BASIC_AUTH_PASSWORD is set.
Action: Upgrade django-basic-auth-ip-whitelist to 0.3.4 or later.
pip install django-basic-auth-ip-whitelist==0.3.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.3.4 | - |
Fixed versions
| 0.3.4 |
Sources
- osv: PYSEC-2020-37
- https://groups.google.com/forum/#!msg/django-developers/iAaq0pvHXuA/fpUuwjK3i2wJ
- https://github.com/tm-kn/django-basic-auth-ip-whitelist/security/advisories/GHSA-m38j-pmg3-v5x5
CVE-2020-4071 · published · modified · JSON