CVE-2020-35681

Advisory

Channels 3.0.3 includes a fix for CVE-2020-35681. See also: <https://channels.readthedocs.io/en/latest/releases/3.0.3.html>.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

------------------

* Fixed a bug in Channels 3.0 where the legacy ``channels.http.AsgiHandler``
would not correctly isolate per-request scopes.

This is a security release for CVE-2020-35681. Please see the `Version 3.0.3
release notes
<https://channels.readthedocs.io/en/latest/releases/3.0.3.html>`_ for full
details.

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35681
• https://github.com/django/channels/releases
• https://channels.readthedocs.io/en/stable/releases/3.0.3.html
• https://channels.readthedocs.io/en/stable/releases/index.html