CVE-2020-35678 Open Redirect in autobahn
Attackers can inject redirect headers in Autobahn|Python, potentially leading to phishing or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-35678?
CVE-2020-35678 is a medium-severity vulnerability in n/a, published on 27 Dec 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Autobahn|Python before 20.12.3 allows redirect header injection.
Weakness: CWE-601
Which versions are affected by CVE-2020-35678?
3 open source packages ship an affected version, including autobahn. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
autobahn PyPI | All versions | 20.12.3 |
autobahn PyPI | All versions | 20.12.3 |
autobahn PyPI | All versions | 20.12.3 |
Linux distribution packages (7)
python-autobahn SUSE:Package Hub 15 SP1 | All versions | 17.10.1-bp151.4.3.1 |
python-autobahn SUSE:Package Hub 15 SP2 | All versions | 17.10.1-bp152.4.3.1 |
python-autobahn openSUSE:Leap 15.1 | All versions | 17.10.1-lp151.3.3.1 |
python-autobahn openSUSE:Leap 15.2 | All versions | 17.10.1-lp152.4.3.1 |
python-autobahn openSUSE:Tumbleweed | All versions | 21.3.1-1.3 |
python-autobahn openSUSE:Tumbleweed | All versions | 23.6.2-3.1 |
python-autobahn openSUSE:Tumbleweed | All versions | 26.7.1-1.1 |
Products include Crossbar Autobahn.
How do I fix CVE-2020-35678?
Upgrade autobahn to 20.12.3 or later.
Is CVE-2020-35678 being exploited?
There is no known exploitation of CVE-2020-35678 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2020-35678, GHSA-gwp7-vqr5-h33h, PYSEC-2020-25, UBUNTU-CVE-2020-35678, openSUSE-SU-2021:0132-1, openSUSE-SU-2021:0152-1 and 5 more.