CVE-2020-35681
2 advisories.
PyPI/channels CVE-2020-35681: high 7.4
Django Channels leakage of session identifiers using legacy AsgiHandler
Action: Upgrade channels to 3.0.3 or later.
pip install channels==3.0.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.0.3 | - |
Fixed versions
| 3.0.3 |
Sources
- osv: GHSA-v542-8q9x-cffc
- https://nvd.nist.gov/vuln/detail/CVE-2020-35681
- https://github.com/django/channels/commit/e85874d9630474986a6937430eac52db79a2a022
- https://channels.readthedocs.io/en/stable/releases/3.0.3.html
- https://channels.readthedocs.io/en/stable/releases/index.html
- https://github.com/advisories/GHSA-v542-8q9x-cffc
- https://github.com/django/channels
- https://github.com/django/channels/releases
- https://github.com/pypa/advisory-database/tree/main/vulns/channels/PYSEC-2021-113.yaml
CVE-2020-35681 · published · modified · JSON
PyPI/channels CVE-2020-35681: unknown
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type request
Action: Upgrade channels to 3.0.3 or later.
pip install channels==3.0.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0 | 3.0.3 | - |
Fixed versions
| 3.0.3 |
Sources
- osv: PYSEC-2021-113
- https://github.com/django/channels/releases
- https://channels.readthedocs.io/en/stable/releases/3.0.3.html
- https://channels.readthedocs.io/en/stable/releases/index.html
- https://github.com/advisories/GHSA-v542-8q9x-cffc
CVE-2020-35681 · published · modified · JSON