CVE-2020-35681: 
Python vulnerability analysis and mitigation

Django Channels 3.x before 3.0.3 contains a security vulnerability (CVE-2020-35681) that allows remote attackers to obtain sensitive information from a different request scope. The vulnerability affects the legacy channels.http.AsgiHandler class, which is used for handling HTTP type requests in an ASGI environment prior to Django 3.0. The issue was discovered and fixed in February 2021 (NVD, Channels Docs).

The vulnerability stems from incorrect separation of request scopes in Channels 3.0 when using the legacy channels.http.AsgiHandler class. With correct timing, responses could be sent to the wrong client due to this scope separation issue. The vulnerability has a CVSS v3.1 Base Score of 7.4 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H. The issue specifically affects installations using ProtocolTypeRouter without explicitly specifying the handler for the 'http' key, or those explicitly using channels.http.AsgiHandler (NVD, Channels Docs).

The vulnerability can result in potential leakage of session identifiers and other sensitive data to wrong clients. In many cases, the issue would result in a crash, but under specific timing conditions, it could lead to information disclosure where responses are sent to incorrect clients (Channels Docs).

The vulnerability requires network access and specific timing conditions to exploit. While the attack complexity is rated as high, it requires no privileges or user interaction to exploit. The vulnerability affects Channels 3.0.x versions before 3.0.3, particularly when using the legacy AsgiHandler (NVD).

The vulnerability was fixed in Channels 3.0.3. Users are recommended to update to this version or later. Additionally, it is recommended to update to Django 3.0+ and use the Django provided ASGIHandler instead of the legacy channels.http.AsgiHandler. For those unable to update immediately, note that both an unspecified handler for the 'http' key and using channels.http.AsgiHandler are deprecated and will raise a warning from Channels v3.0.0 (Channels Docs).