CVE-2018-6596

Опубликовано: 03 фев. 2018

Источник: nvd

CVSS3: 9.1

CVSS2: 6.4

EPSS Низкий

Описание

webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events.

Ссылки

https://bugs.debian.org/889450
Issue Tracking
Patch
Third Party Advisory
https://github.com/anymail/django-anymail/commit/c07998304b4a31df4c61deddcb03d3607a04691b
Patch
https://github.com/anymail/django-anymail/commit/db586ede1fbb41dce21310ea28ae15a1cf1286c5
Patch
https://github.com/anymail/django-anymail/releases/tag/v1.2.1
Release Notes
https://github.com/anymail/django-anymail/releases/tag/v1.3
Release Notes
https://www.debian.org/security/2018/dsa-4107
Third Party Advisory
https://bugs.debian.org/889450
Issue Tracking
Patch
Third Party Advisory
https://github.com/anymail/django-anymail/commit/c07998304b4a31df4c61deddcb03d3607a04691b
Patch
https://github.com/anymail/django-anymail/commit/db586ede1fbb41dce21310ea28ae15a1cf1286c5
Patch
https://github.com/anymail/django-anymail/releases/tag/v1.2.1
Release Notes
https://github.com/anymail/django-anymail/releases/tag/v1.3
Release Notes
https://www.debian.org/security/2018/dsa-4107
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:django-anymail_project:django-anymail:*:*:*:*:*:*:*:*

Версия до 1.2.1 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 66%

0.00506

Низкий

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2018-6596

CVSS3: 9.1

ubuntu

около 8 лет назад

CVE-2018-6596

CVSS3: 9.1

debian

около 8 лет назад

webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone ...

GHSA-hxf9-7h4c-f5jv

CVSS3: 9.1

github

больше 7 лет назад

Django-Anymail prone to a timing attack

EPSS

Процентиль: 66%

0.00506

Низкий

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-200