{"id":"CVE-2020-35678","aliases":["DEBIAN-CVE-2020-35678","EUVD-2020-0049","GHSA-gwp7-vqr5-h33h","PYSEC-2020-25","UBUNTU-CVE-2020-35678","openSUSE-SU-2021:0132-1","openSUSE-SU-2021:0152-1","openSUSE-SU-2021:0176-1","openSUSE-SU-2021:0180-1","openSUSE-SU-2024:11216-1","openSUSE-SU-2024:13902-1","openSUSE-SU-2026:11780-1"],"status":"published","title":"Open Redirect in autobahn","description":"Autobahn|Python before 20.12.3 allows redirect header injection.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01443,"percentile":0.73456,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2020-12-27T00:00:10Z","modified":"2026-10-26T12:02:32Z","fixes":[{"ecosystem":"PyPI","package":"autobahn","fixed_in":["20.12.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-autobahn","fixed_in":["17.10.1+dfsg1-7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-autobahn","fixed_in":["17.10.1+dfsg1-7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-autobahn","fixed_in":["17.10.1+dfsg1-7"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"python-autobahn","fixed_in":["17.10.1-lp151.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"python-autobahn","fixed_in":["17.10.1-lp152.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"python-autobahn","fixed_in":["17.10.1-bp152.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP1","package":"python-autobahn","fixed_in":["17.10.1-bp151.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-autobahn","fixed_in":["21.3.1-1.3","23.6.2-3.1","26.7.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.12.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.10.1+dfsg1-7"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.10.1+dfsg1-7"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.10.1+dfsg1-7"}]}]},{"source":"osv","ecosystem":"PyPI","package":"autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.12.3"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.5.post2","0.10.6","0.10.7","0.10.8","0.10.9","0.11.0","0.12.0","0.12.1","0.13.0","0.13.1","0.14.0","0.14.1","0.15.0","0.16.0","0.16.1","0.17.0","0.17.1","0.17.2","0.18.0","0.18.1","0.18.2","0.3.1","0.3.2","0.4.0","0.4.1","0.4.10","0.4.2","0.4.3","0.5.0","0.5.1","0.5.14","0.5.2","0.5.5","0.5.8","0.5.9","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.1","0.8.10","0.8.11","0.8.12","0.8.13","0.8.14","0.8.15","0.8.2","0.8.3","0.8.4","0.8.4-2","0.8.4-3","0.8.5","0.8.6","0.8.7","0.8.8","0.8.9","0.9.0","0.9.1","0.9.2","0.9.3","0.9.3-2","0.9.3-3","0.9.4","0.9.4-2","0.9.5","0.9.6","17.10.1","17.5.1","17.6.1","17.6.2","17.7.1","17.8.1","17.9.1","17.9.2","17.9.3","18.10.1","18.11.1","18.11.2","18.12.1","18.3.1","18.4.1","18.5.1","18.5.2","18.6.1","18.7.1","18.8.1","18.8.2","18.9.1","18.9.2","19.1.1","19.10.1","19.11.1","19.11.2","19.2.1","19.3.1","19.3.2","19.3.3","19.5.1","19.6.1","19.6.2","19.7.1","19.7.2","19.8.1","19.9.1","19.9.2","19.9.3","20.1.2","20.1.3","20.12.1","20.12.2","20.2.1","20.2.2","20.3.1","20.4.1","20.4.2","20.4.3","20.6.1","20.6.2","20.7.1"]},{"source":"osv","ecosystem":"PyPI","package":"autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.12.3"}]}],"versions":["0.3.1","0.3.2","0.4.0","0.4.1","0.4.2","0.4.3","0.4.10","0.5.0","0.5.1","0.5.2","0.5.5","0.5.8","0.5.9","0.5.14","0.6.3","0.6.4","0.6.5","0.7.0","0.7.1","0.7.2","0.7.3","0.7.4","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.4-2","0.8.4-3","0.8.5","0.8.6","0.8.7","0.8.8","0.8.9","0.8.10","0.8.11","0.8.12","0.8.13","0.8.14","0.8.15","0.9.0","0.9.1","0.9.2","0.9.3","0.9.3-2","0.9.3-3","0.9.4","0.9.4-2","0.9.5","0.9.6","0.10.0","0.10.1","0.10.2","0.10.3","0.10.4","0.10.5","0.10.5.post2","0.10.6","0.10.7","0.10.8","0.10.9","0.11.0","0.12.0","0.12.1","0.13.0","0.13.1","0.14.0","0.14.1","0.15.0","0.16.0","0.16.1","0.17.0","0.17.1","0.17.2","0.18.0","0.18.1","0.18.2","17.5.1","17.6.1","17.6.2","17.7.1","17.8.1","17.9.1","17.9.2","17.9.3","17.10.1","18.3.1","18.4.1","18.5.1","18.5.2","18.6.1","18.7.1","18.8.1","18.8.2","18.9.1","18.9.2","18.10.1","18.11.1","18.11.2","18.12.1","19.1.1","19.2.1","19.3.1","19.3.2","19.3.3","19.5.1","19.6.1","19.6.2","19.7.1","19.7.2","19.8.1","19.9.1","19.9.2","19.9.3","19.10.1","19.11.1","19.11.2","20.1.2","20.1.3","20.2.1","20.2.2","20.3.1","20.4.1","20.4.2","20.4.3","20.6.1","20.6.2","20.7.1","20.12.1","20.12.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.3+dfsg1-2","0.10.3+dfsg1-3","0.10.3+dfsg1-5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.1+dfsg1-2ubuntu1","17.10.1+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.10.1+dfsg1-5","17.10.1+dfsg1-6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["17.10.1+dfsg1-7","21.11.1+dfsg1-2","21.11.1+dfsg1-2build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["22.7.1+dfsg1-3","22.7.1+dfsg1-4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.1.2+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["24.4.2+dfsg1-5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.1.2+dfsg1-2","24.4.2+dfsg1-4","24.4.2+dfsg1-5"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.10.1-lp151.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.10.1-lp152.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.10.1-bp152.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.10.1-bp151.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.3.1-1.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.6.2-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.7.1-1.1"}]}]}],"products":[{"vendor":"crossbar","product":"autobahn"}],"references":[{"url":"https://github.com/crossbario/autobahn-python","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","package","web","report"]},{"url":"https://github.com/crossbario/autobahn-python/compare/v20.12.2...v20.12.3","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://pypi.org/project/autobahn/20.12.3/","tags":["x_refsource_CONFIRM","x_transferred","Product","Third Party Advisory","package","report"]},{"url":"https://autobahn.readthedocs.io/en/latest/changelog.html","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/crossbario/autobahn-python/pull/1439","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35678","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/autobahn/PYSEC-2020-25.yaml","tags":["web"]},{"url":"https://pypi.org/project/autobahn/20.12.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gwp7-vqr5-h33h","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-35678","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-35678","tags":["report"]},{"url":"https://github.com/crossbario/autobahn-python/commit/f7b7ad5c1066bdcc551775b73da15dca5c111623","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-35678","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HC22UZIJVKS65SOAIGLLU6XWHC73XYOM/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1180570","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35678","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MXPO3Q3UW27SSZ5A6MCOSCPUHQM7HB7N/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TD6HWC7EEESMXCVV3M3M6OYUZFEGILI2/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YFFLEQLA5JEDUCNZ6SDNWX77OSIWNZNB/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-35678","description":"Autobahn|Python before 20.12.3 allows redirect header injection.","status":"published","published":"2020-12-27T00:00:10Z","modified":"2024-08-04T17:09:14.898Z","updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2020-0049","description":"Autobahn|Python before 20.12.3 allows redirect header injection.","status":"published","published":"2020-12-27T00:00:10Z","modified":"2024-08-04T17:09:14Z","updated_at":"2026-11-03T03:07:05.848444Z"}],"ghsa":[{"id":"GHSA-gwp7-vqr5-h33h","title":"Open Redirect in autobahn","description":"Autobahn|Python before 20.12.3 allows redirect header injection.","status":"published","published":"2021-04-20T16:13:45Z","modified":"2024-09-04T19:35:18Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:38:01.080229Z"}],"nvd":[{"id":"CVE-2020-35678","description":"Autobahn|Python before 20.12.3 allows redirect header injection.","status":"published","published":"2020-12-27T00:15:12.613Z","modified":"2026-06-17T03:14:06.853Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:06:28.340168Z"}],"osv":[{"id":"CVE-2020-35678","description":"Autobahn|Python before 20.12.3 allows redirect header injection.","status":"published","published":"2020-12-27T00:15:12.613Z","modified":"2026-10-20T10:53:21.84637446Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-35678","description":"Autobahn|Python before 20.12.3 allows redirect header injection.","status":"published","published":"2020-12-27T00:15:12.613Z","modified":"2026-10-26T12:02:32.143351906Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"GHSA-gwp7-vqr5-h33h","title":"Open Redirect in autobahn","description":"Autobahn|Python before 20.12.3 allows redirect header injection.","status":"published","published":"2021-04-20T16:13:45Z","modified":"2024-09-04T19:45:48.865296Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"UBUNTU-CVE-2020-35678","description":"Autobahn|Python before 20.12.3 allows redirect header injection.","status":"published","published":"2020-12-27T00:15:00Z","modified":"2026-10-17T12:56:56.059387596Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:25.179924Z"},{"id":"openSUSE-SU-2021:0132-1","title":"Security update for python-autobahn","description":"This update for python-autobahn fixes the following issue:\n\n- CVE-2020-35678: Fixed a redirect header injection (boo#1180570).\n","status":"published","published":"2021-01-21T11:24:05Z","modified":"2026-02-04T04:25:58.642016Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0152-1","title":"Security update for python-autobahn","description":"This update for python-autobahn fixes the following issue:\n\n- CVE-2020-35678: Fixed a redirect header injection (boo#1180570).\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2021-01-24T15:21:39Z","modified":"2026-02-04T03:31:48.900233Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0176-1","title":"Security update for python-autobahn","description":"This update for python-autobahn fixes the following issue:\n\n- CVE-2020-35678: Fixed a redirect header injection (boo#1180570).\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-01-27T17:24:03Z","modified":"2026-02-04T02:27:55.27481Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0180-1","title":"Security update for python-autobahn","description":"This update for python-autobahn fixes the following issue:\n\n- CVE-2020-35678: Fixed a redirect header injection (boo#1180570).\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2021-01-28T11:26:59Z","modified":"2026-02-04T03:39:53.639935Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:11216-1","title":"python38-autobahn-21.3.1-1.3 on GA media","description":"These are all security issues fixed in the python38-autobahn-21.3.1-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:00:28.705442Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:13902-1","title":"python310-autobahn-23.6.2-3.1 on GA media","description":"These are all security issues fixed in the python310-autobahn-23.6.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:12:07.339069Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11780-1","title":"python313-autobahn-26.7.1-1.1 on GA media","description":"These are all security issues fixed in the python313-autobahn-26.7.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-09-15T10:15:05.08295835Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"PYSEC-2020-25","description":"Autobahn|Python before 20.12.3 allows redirect header injection.","status":"published","published":"2020-12-27T00:15:00Z","modified":"2023-11-08T04:03:35.306822Z","updated_at":"2026-11-02T15:52:52.192131Z"}]}}