Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

channels

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.2PyPIAmendedPublished

    Django Channels leakage of session identifiers using legacy AsgiHandler

    CVE-2020-35681 · GHSA-v542-8q9x-cffc

    Affected
    • PyPI channels >= 3.0.0, < 3.0.3
    Fixed in
    3.0.3· Vendor fix available
    Issue
    Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channels 3.0. In many cases this would result in a crash but, with correct timing, responses could be sent to the wrong client, resulting in potential leakage of session identifiers and other sensitive data. Note that this affects only the legacy Channels provided class, and not Django's similar ASGIHandler, available from Django 3.0.

    Recommended action: Upgrade to 3.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →