CVE-2020-10109

Advisory

Daphne 4.0.0b1 updates its dependency 'twisted' requirement to '>=22.4' to include security fixes.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

--------------------

This is a beta release to allow testing compatibility with the upcoming Channels
4.0.

* Dropped support for Python 3.6.

* Updated dependencies to the latest versions.

Previously a range of Twisted versions have been supported. Recent Twisted
releases (22.2, 22.4) have issued security fixes, so those are now the
minimum supported version. Given the stability of Twisted, supporting a
range of versions does not represent a good use of maintainer time. Going
forward the latest Twisted version will be required.

* Set ``daphne`` as default ``Server`` header.

This can be configured with the ``--server-name`` CLI argument.

Added the new ``--no-server-name`` CLI argument to disable the ``Server``
header, which is equivalent to ``--server-name=` (an empty name).

* Added ``--log-fmt`` CLI argument.

* Added support for ``ASGI_THREADS`` environment variable, setting the maximum
number of workers used by a ``SyncToAsync`` thread-pool executor.

Set e.g. ``ASGI_THREADS=4 daphne ...`` when running to limit the number of
workers.

* Added a ``runserver`` command to run an ASGI Django development server.

Added ``"daphne"`` to the ``INSTALLED_APPS`` setting, before
``"django.contrib.staticfiles"`` to enable:

INSTALLED_APPS = [
"daphne",
...
]

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10109