Sensitive Data Leakage in Django Channels 3.x - CVE-2020-35681
Summary
DEBIAN-CVE-2020-35681: Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. Affects python-django-channels versions < 3.0.3-1. Fixed in 3.0.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django Channels is an extension of the Django web framework that adds support for handling WebSockets, HTTP2, and other asynchronous protocols. It allows developers to build real-time applications with ease. However, a vulnerability was discovered in versions prior to 3.0.3, where the legacy channels.http.AsgiHandler class failed to properly separate request scopes, leading to potential data leakage.
Vulnerability Detail
The vulnerability identified as CVE-2020-35681 affects Django Channels 3.x versions before 3.0.3. It allows remote attackers to access sensitive information from different request scopes due to improper handling of HTTP requests in the legacy AsgiHandler class. This could lead to responses being sent to the wrong client, potentially exposing session identifiers and other sensitive data. The issue arises from the failure to correctly isolate request scopes, which could result in crashes or data leakage under specific timing conditions.
How To Fix
Minimum fixed version
3.0.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-django-channelsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the legacy AsgiHandler if it is not essential for your application. This can help mitigate the risk of sensitive data leakage until the package is updated. Additionally, review your application’s request handling to ensure proper isolation of request scopes.
Conclusion
The CVE-2020-35681 vulnerability in Django Channels poses a significant risk of sensitive data leakage due to improper request scope handling. It is crucial for developers using affected versions to update to 3.0.3 or later to safeguard their applications. Temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for python-django-channels →
FAQ
CVE-2020-35681 is a vulnerability in Django Channels that allows remote attackers to access sensitive information due to improper request scope handling.
Django Channels versions prior to 3.0.3 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate updates are not possible, consider disabling the legacy AsgiHandler and reviewing your request handling to mitigate risks.
More information can be found in the official CVE database or the Debian security advisory linked in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-django-channels.
