id: PYSEC-2020-25
details: Autobahn|Python before 20.12.3 allows redirect header injection.
affected:
- package:
    name: autobahn
    ecosystem: PyPI
    purl: pkg:pypi/autobahn
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 20.12.3
  versions:
  - 0.3.1
  - 0.3.2
  - 0.4.0
  - 0.4.1
  - 0.4.2
  - 0.4.3
  - 0.4.10
  - 0.5.0
  - 0.5.1
  - 0.5.2
  - 0.5.5
  - 0.5.8
  - 0.5.9
  - 0.5.14
  - 0.6.3
  - 0.6.4
  - 0.6.5
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.7.3
  - 0.7.4
  - 0.8.0
  - 0.8.1
  - 0.8.2
  - 0.8.3
  - 0.8.4
  - 0.8.4-2
  - 0.8.4-3
  - 0.8.5
  - 0.8.6
  - 0.8.7
  - 0.8.8
  - 0.8.9
  - 0.8.10
  - 0.8.11
  - 0.8.12
  - 0.8.13
  - 0.8.14
  - 0.8.15
  - 0.9.0
  - 0.9.1
  - 0.9.2
  - 0.9.3
  - 0.9.3-2
  - 0.9.3-3
  - 0.9.4
  - 0.9.4-2
  - 0.9.5
  - 0.9.6
  - 0.10.0
  - 0.10.1
  - 0.10.2
  - 0.10.3
  - 0.10.4
  - 0.10.5
  - 0.10.5.post2
  - 0.10.6
  - 0.10.7
  - 0.10.8
  - 0.10.9
  - 0.11.0
  - 0.12.0
  - 0.12.1
  - 0.13.0
  - 0.13.1
  - 0.14.0
  - 0.14.1
  - 0.15.0
  - 0.16.0
  - 0.16.1
  - 0.17.0
  - 0.17.1
  - 0.17.2
  - 0.18.0
  - 0.18.1
  - 0.18.2
  - 17.5.1
  - 17.6.1
  - 17.6.2
  - 17.7.1
  - 17.8.1
  - 17.9.1
  - 17.9.2
  - 17.9.3
  - 17.10.1
  - 18.3.1
  - 18.4.1
  - 18.5.1
  - 18.5.2
  - 18.6.1
  - 18.7.1
  - 18.8.1
  - 18.8.2
  - 18.9.1
  - 18.9.2
  - 18.10.1
  - 18.11.1
  - 18.11.2
  - 18.12.1
  - 19.1.1
  - 19.2.1
  - 19.3.1
  - 19.3.2
  - 19.3.3
  - 19.5.1
  - 19.6.1
  - 19.6.2
  - 19.7.1
  - 19.7.2
  - 19.8.1
  - 19.9.1
  - 19.9.2
  - 19.9.3
  - 19.10.1
  - 19.11.1
  - 19.11.2
  - 20.1.2
  - 20.1.3
  - 20.2.1
  - 20.2.2
  - 20.3.1
  - 20.4.1
  - 20.4.2
  - 20.4.3
  - 20.6.1
  - 20.6.2
  - 20.7.1
  - 20.12.1
  - 20.12.2
references:
- type: WEB
  url: https://github.com/crossbario/autobahn-python/compare/v20.12.2...v20.12.3
- type: WEB
  url: https://github.com/crossbario/autobahn-python
- type: WEB
  url: https://github.com/crossbario/autobahn-python/pull/1439
- type: PACKAGE
  url: https://pypi.org/project/autobahn/20.12.3/
- type: WEB
  url: https://autobahn.readthedocs.io/en/latest/changelog.html
- type: ADVISORY
  url: https://github.com/advisories/GHSA-gwp7-vqr5-h33h
aliases:
- CVE-2020-35678
- GHSA-gwp7-vqr5-h33h
modified: '2020-12-30T15:37:00Z'
published: '2020-12-27T00:15:00Z'