CVE catalog
CVE-2020-35681
python-django-channels: CVE-2020-35681
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 2.66% · Oct 25, 2026
Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope. The legacy channels.http.AsgiHandler class, used for handling HTTP type requests in an ASGI environment prior to Django 3.0, did not correctly separate request scopes in Channels 3.0. In many cases this would result in a crash but, with correct timing, responses could be sent to the wrong client, resulting in potential leakage of session identifiers and other sensitive data. Note that this affects only the legacy Channels provided class, and not Django's similar ASGIHandler, available from Django 3.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | python-django-channels | sid | 4.3.2-2 | fixed |
| Debian | python-django-channels | forky | 4.3.2-2 | fixed |
| Debian | python-django-channels | trixie | 4.2.2-1 | fixed |
| Debian | python-django-channels | bookworm | 4.0.0-1 | fixed |
| Ubuntu | python-django-channels | 18.04 | 1.1.8.1-1 | vulnerable |
| Ubuntu | python-django-channels | 20.04 | 2.2.0-1 | vulnerable |
| Ubuntu | python-django-channels | 20.04 | 2.3.0-1 | vulnerable |
| Ubuntu | python-django-channels | 20.04 | 2.3.1-1 | vulnerable |
| Ubuntu | python-django-channels | 20.04 | 2.4.0-1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | python-django-channels | source | sid | 3.0.3-1 | not yet assigned | Not reported | [979376] |
| Debian | python-django-channels | source | forky | 3.0.3-1 | not yet assigned | Not reported | [979376] |
| Debian | python-django-channels | source | trixie | 3.0.3-1 | not yet assigned | Not reported | [979376] |
| Debian | python-django-channels | source | bookworm | 3.0.3-1 | not yet assigned | Not reported | [979376] |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [python3-django-channels]Fixed
Source package: [python-django-channels]
Details (2)
4.0.0-1· all · bookwormFixed · Fixed:
3.0.3-1dsa · python-django-channels · debian · bookworm; dsa · python-django-channels · debian · 12
4.0.0-1· all · bookwormFixed · Fixed:
3.0.3-1dsa · python-django-channels · debian · bookworm; dsa · python-django-channels · debian · 12
- [python-django-channels-doc]Fixed
Source package: [python-django-channels]
Details (2)
4.0.0-1· all · bookwormFixed · Fixed:
3.0.3-1dsa · python-django-channels · debian · bookworm; dsa · python-django-channels · debian · 12
4.0.0-1· all · bookwormFixed · Fixed:
3.0.3-1dsa · python-django-channels · debian · bookworm; dsa · python-django-channels · debian · 12
[Debian 13 (Trixie)]
- [python3-django-channels]Fixed
Source package: [python-django-channels]
Details (2)
4.2.2-1· all · trixieFixed · Fixed:
3.0.3-1dsa · python-django-channels · debian · 13
4.2.2-1· all · trixieFixed · Fixed:
3.0.3-1dsa · python-django-channels · debian · 13
- [python-django-channels-doc]Fixed
Source package: [python-django-channels]
Details (2)
4.2.2-1· all · trixieFixed · Fixed:
3.0.3-1dsa · python-django-channels · debian · 13
4.2.2-1· all · trixieFixed · Fixed:
3.0.3-1dsa · python-django-channels · debian · 13
Observed: