There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on
    the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events.
    (CVE-2018-6596)

發現 Django 多重 ESP 電子郵件後端 Anymail 的 webhook 驗證容易受到計時攻擊。遠端攻擊者可利用此缺陷，取得 WEBHOOK_AUTHORIZATION 機密並發表任意電子郵件追蹤事件。

已发现用于多个 ESP 的 Django 电子邮件后端 Anymail 的 webhook 验证容易受到时序攻击。远程攻击者可利用此缺陷获得 WEBHOOK_AUTHORIZATION 机密并发布任意电子邮件跟踪事件。

複数のESP用のDjangoメールバックエンドであるAnymailのwebhook検証が、タイミング攻撃に脆弱であることが判明しました。リモート攻撃者がこの欠陥を利用して、WEBHOOK_AUTHORIZATIONシークレットを取得し、任意のメール追跡イベントを投稿する可能性があります。

It was discovered that the webhook validation of Anymail, a Django email backends for multiple ESPs, is prone to a timing attack. A remote attacker can take advantage of this flaw to obtain a WEBHOOK_AUTHORIZATION secret and post arbitrary email tracking events.

ID	名稱	產品	系列	已發布	已更新	嚴重性
422422	SCA: security update for django-anymail (GHSA-hxf9-7h4c-f5jv)	Tenable Cloud Security	SCA Checks	2025/3/28	2026/7/2	critical
422422	SCA: security update for django-anymail (GHSA-hxf9-7h4c-f5jv)	Tenable Self-Hosted Container Security	SCA Checks	2025/3/28	2026/7/2	critical
106662	Debian DSA-4107-1：django-anymail - 安全性更新	Nessus	Debian Local Security Checks	2018/2/8	2025/10/30	critical
106662	Debian DSA-4107-1：django-anymail - 安全更新	Nessus	Debian Local Security Checks	2018/2/8	2025/10/30	critical
106662	DebianDSA-4107-1：django-anymail - セキュリティ更新	Nessus	Debian Local Security Checks	2018/2/8	2025/10/30	critical
106662	Debian DSA-4107-1 : django-anymail - security update	Nessus	Debian Local Security Checks	2018/2/8	2025/10/30	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical