{"action":"Upgrade channels to 3.0.3 or later.","affected":[{"fixed":"3.0.3","introduced":"3.0.0"}],"component":"channels","cve_ids":["CVE-2020-35681"],"ecosystem":"PyPI","epss":0.02658,"exploited":false,"fixed_versions":["3.0.3"],"ghsa_id":"GHSA-v542-8q9x-cffc","id":"tcs_01M5KFZ81EAMT7BZ27ZGNCSXPN","modified_at":"2024-09-13T18:01:43.817869Z","published_at":"2021-03-19T21:29:02Z","references":["https://osv.dev/vulnerability/GHSA-v542-8q9x-cffc","https://nvd.nist.gov/vuln/detail/CVE-2020-35681","https://github.com/django/channels/commit/e85874d9630474986a6937430eac52db79a2a022","https://channels.readthedocs.io/en/stable/releases/3.0.3.html","https://channels.readthedocs.io/en/stable/releases/index.html","https://github.com/advisories/GHSA-v542-8q9x-cffc","https://github.com/django/channels","https://github.com/django/channels/releases","https://github.com/pypa/advisory-database/tree/main/vulns/channels/PYSEC-2021-113.yaml"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-v542-8q9x-cffc","url":"https://osv.dev/vulnerability/GHSA-v542-8q9x-cffc"}],"summary":"Django Channels leakage of session identifiers using legacy AsgiHandler"}