Read the docs
TI-2020-18149 Aliases CVE-2020-35678GHSA-gwp7-vqr5-h33h

Autobahn|Python before 20.12.3 allows redirect header injection.

Priority LOW 30CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 3 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.

Summary

Autobahn|Python before 20.12.3 allows redirect header injection.

Why it matters now

EPSS 0.01443 73rd percentileScored 2026-11-07
Fix Partial autobahn (PyPI): 20.12.3Red Hat: 3 advisoriesRed Hat: 3 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—autobahn (PyPI)before 20.12.320.12.3Patch availableGHSA-gwp7-vqr5-h33h
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • autobahn (PyPI) Vendor— Affected before 20.12.3 Fixed in 20.12.3 Patch available GHSA-gwp7-vqr5-h33h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:crossbar:autobahn:*:*:*:*:*:*:*:*before 20.12.3VulnerableCrossbar
  • cpe:2.3:a:crossbar:autobahn:*:*:*:*:*:*:*:* Versions before 20.12.3 Vulnerable ·Crossbar

Remediation

  • Fix · GHSA-gwp7-vqr5-h33h autobahn (PyPI) Fixed in 20.12.3 Advisory →

Red Hat 3 advisories

  • RHSA-2021:0780 Released 2021-03-09 · Red Hat rating Important
    Red Hat Ansible Tower 3.8.2-1 - Container security and bug fix update
    • Red Hat Ansible Tower 3.8 for RHEL 7 ansible-tower-38/ansible-runner-rhel7, ansible-tower-38/ansible-tower-rhel7
  • RHSA-2021:0778 Released 2021-03-09 · Red Hat rating Important
    Red Hat Ansible Tower 3.6.7-1 - Container security and bug fix update
    • Red Hat Ansible Tower 3.6 for RHEL 7 ansible-tower-36/ansible-tower
  • RHSA-2021:0779 Released 2021-03-09 · Red Hat rating Important
    Red Hat Ansible Tower 3.7.5-1 - Container security and bug fix update
    • Red Hat Ansible Tower 3.7 for RHEL 7 ansible-tower-37/ansible-tower-rhel7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 1.2AffectedNo fix yet
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 16.1AffectedNo fix planned: Will not fix
Red Hat Quay 3AffectedNo fix planned: Will not fix
Red Hat Ansible Tower 3.6 for RHEL 7Fixed RHSA-2021:0778
Red Hat Ansible Tower 3.7 for RHEL 7Fixed RHSA-2021:0779
Red Hat Ansible Tower 3.8 for RHEL 7Fixed RHSA-2021:0780

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-35678
  2. 2026-10-03 Alias added: GHSA-gwp7-vqr5-h33h

References

Patch 2

Advisory 4

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences