CVE-2018-6596

webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 66%
VendorProductVersion
django-anymail_projectdjango-anymail
𝑥
< 1.2.1
debiandebian_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
django-anymail
bullseye
7.1.0-1
fixed
bookworm
9.0-1
fixed
sid
12.0-1
fixed
trixie
12.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
django-anymail
bionic
not-affected
artful
ignored
xenial
dne
trusty
dne
Common Weakness Enumeration
References
https://bugs.debian.org/889450
https://github.com/anymail/django-anymail/commit/c07998304b4a31df4c61deddcb03d3607a04691b
https://github.com/anymail/django-anymail/commit/db586ede1fbb41dce21310ea28ae15a1cf1286c5
https://github.com/anymail/django-anymail/releases/tag/v1.2.1
https://github.com/anymail/django-anymail/releases/tag/v1.3
https://www.debian.org/security/2018/dsa-4107
https://bugs.debian.org/889450
https://github.com/anymail/django-anymail/commit/c07998304b4a31df4c61deddcb03d3607a04691b
https://github.com/anymail/django-anymail/commit/db586ede1fbb41dce21310ea28ae15a1cf1286c5
https://github.com/anymail/django-anymail/releases/tag/v1.2.1
https://github.com/anymail/django-anymail/releases/tag/v1.3
https://www.debian.org/security/2018/dsa-4107