Safety vulnerability ID: 35178
The information on this page was manually curated by our Cybersecurity Intelligence Team.
In django-anymail before 1.4 the webhook validation was vulnerable to a timing attack. An attacker could have used this to obtain the WEBHOOK_AUTHORIZATION shared secret, potentially allowing them to post fabricated or malicious email tracking events to the app.
Latest version: 10.3
Django email backends and webhooks for Amazon SES, Brevo (Sendinblue), MailerSend, Mailgun, Mailjet, Mandrill, Postal, Postmark, Resend, SendGrid, SparkPost and Unisender Go
Security fix
Prevent timing attack on WEBHOOK_AUTHORIZATION secret
If you are using Anymail's tracking webhooks, you should upgrade to this release, and you may want to rotate to a new WEBHOOK_AUTHORIZATION shared secret (see [docs](http://anymail.readthedocs.io/en/stable/tips/securing_webhooks/use-a-shared-authorization-secret)). You should definitely change your webhook auth if your logs indicate attempted exploit.
*More information*
Anymail's webhook validation was vulnerable to a timing attack. An attacker could have used this to obtain your WEBHOOK_AUTHORIZATION shared secret, potentially allowing them to post fabricated or malicious email tracking events to your app.
There have not been any reports of attempted exploit. (The vulnerability was discovered through code review.) Attempts would be visible in HTTP logs as a very large number of 400 responses on Anymail's webhook urls (by default "/anymail/*esp_name*/tracking/"), and in Python error monitoring as a very large number of AnymailWebhookValidationFailure exceptions.
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application