CVE-2018-6596
Summary
| CVE | CVE-2018-6596 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2018-02-03 21:29:00 UTC |
|---|
| Updated | 2018-03-02 13:56:00 UTC |
|---|
| Description | webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Release v1.2.1 · anymail/django-anymail · GitHub |
CONFIRM |
github.com |
Release Notes |
| Release v1.3 · anymail/django-anymail · GitHub |
CONFIRM |
github.com |
Release Notes |
| Security: prevent timing attack on WEBHOOK_AUTHORIZATION secret · anymail/django-anymail@c079983 · GitHub |
CONFIRM |
github.com |
Patch |
| Debian -- Security Information -- DSA-4107-1 django-anymail |
DEBIAN |
www.debian.org |
Third Party Advisory |
| Security: prevent timing attack on WEBHOOK_AUTHORIZATION secret · anymail/django-anymail@db586ed · GitHub |
CONFIRM |
github.com |
Patch |
| #889450 - django-anymail: CVE-2018-6596: Security issue with timing attack on WEBHOOK_AUTHORIZATION - Debian Bug report logs |
CONFIRM |
bugs.debian.org |
Issue Tracking, Patch, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 981031 Python (pip) Security Update for django-anymail (GHSA-hxf9-7h4c-f5jv)
