{"action":"Upgrade django-basic-auth-ip-whitelist to 0.3.4 or later.","affected":[{"fixed":"0.3.4","introduced":"0"}],"component":"django-basic-auth-ip-whitelist","cve_ids":["CVE-2020-4071"],"ecosystem":"PyPI","epss":0.00358,"exploited":false,"fixed_versions":["0.3.4"],"ghsa_id":"GHSA-m38j-pmg3-v5x5","id":"tcs_01M5KGAMFGTSHTDS6DM0C7DY73","modified_at":"2023-11-08T04:03:50.640117Z","published_at":"2020-06-24T13:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-37","https://groups.google.com/forum/#!msg/django-developers/iAaq0pvHXuA/fpUuwjK3i2wJ","https://github.com/tm-kn/django-basic-auth-ip-whitelist/security/advisories/GHSA-m38j-pmg3-v5x5"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-37","url":"https://osv.dev/vulnerability/PYSEC-2020-37"}],"summary":"In django-basic-auth-ip-whitelist before 0.3.4, a potential timing attack exists on websites where the basic authentication is used or configured, i.e. BASIC_AUTH_LOGIN and BASIC_AUTH_PASSWORD is set."}