CVE-2020-35681: Infoleak
First published: Mon Feb 22 2021(Updated: )
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channels 3.0. In many cases this would result in a crash but, with correct timing, responses could be sent to the wrong client, resulting in potential leakage of session identifiers and other sensitive data. Note that this affects only the legacy Channels provided class, and not Django's similar ASGIHandler, available from Django 3.0.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Djangoproject Channels | >=3.0.0<3.0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://channels.readthedocs.io/en/stable/releases/3.0.3.html
- https://channels.readthedocs.io/en/stable/releases/index.html
- https://github.com/django/channels/releases
- https://nvd.nist.gov/vuln/detail/CVE-2020-35681
- https://github.com/django/channels/commit/e85874d9630474986a6937430eac52db79a2a022
- https://github.com/advisories/GHSA-v542-8q9x-cffc (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/channels/PYSEC-2021-113.yaml
Frequently Asked Questions
What is CVE-2020-35681?
CVE-2020-35681 is a vulnerability in Django Channels 3.x before 3.0.3 that allows remote attackers to obtain sensitive information from a different request scope.
What is the severity of CVE-2020-35681?
CVE-2020-35681 has a severity rating of 7.4 (high).
How does CVE-2020-35681 affect the affected software?
CVE-2020-35681 affects Django Channels 3.x versions before 3.0.3 as well as the Djangoproject Channels package.
How can I fix CVE-2020-35681?
To fix CVE-2020-35681, upgrade to Django Channels 3.0.3 or later.
Where can I find more information about CVE-2020-35681?
More information about CVE-2020-35681 can be found at the NVD (National Vulnerability Database) and the official Django Channels documentation.
- collector/nvd-index
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-v542-8q9x-cffc
- alias/CVE-2020-35681
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/tags
- agent/trending
- vendor/djangoproject
- canonical/djangoproject channels
- version/djangoproject channels/3.0.0
- package-manager/pip