PyPI/channels CVE-2020-35681: high 7.4, EPSS 2.66%
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type request
Action: Upgrade channels to 3.0.3 or later.
pip install channels==3.0.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.0.3 | - |
Fixed versions
| 3.0.3 |
Sources
- osv: PYSEC-2021-113
- nvd: CVE-2020-35681
- https://github.com/django/channels/releases
- https://channels.readthedocs.io/en/stable/releases/3.0.3.html
- https://channels.readthedocs.io/en/stable/releases/index.html
- https://github.com/advisories/GHSA-v542-8q9x-cffc
CVE-2020-35681 · published · modified · JSON