Vulnerability · Published Feb 22, 2021 · Assigned by mitre
CVE-2020-35681
High 7.4
In plain English
A high-severity security flaw in the python-django-channels package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channels 3.0. In many cases this would result in a crash but, with correct timing, responses could be sent to the wrong client, resulting in potential leakage of session identifiers and other sensitive data. Note that this affects only the legacy Channels provided class, and not Django's similar ASGIHandler, available from Django 3.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-django-channels | 3.0.3-1 | DEBIAN-CVE-2020-35681 |
| Debian:13 | python-django-channels | 3.0.3-1 | DEBIAN-CVE-2020-35681 |
| Debian:14 | python-django-channels | 3.0.3-1 | DEBIAN-CVE-2020-35681 |
| PyPI | channels | 3.0.3 | GHSA-v542-8q9x-cffc |
| PyPI | channels | 3.0.3 | PYSEC-2021-113 |
Affected products (as reported)
References
- https://github.com/django/channels/releases x_refsource_MISC
- https://channels.readthedocs.io/en/stable/releases/index.html x_refsource_MISC
- https://channels.readthedocs.io/en/stable/releases/3.0.3.html x_refsource_CONFIRM