CVE-2018-6596

Name: CVE-2018-6596
Creator: NVD / NIST
Published: 2018-02-03T21:29:00.21+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 2.66%

Last modified Jun 17, 2026

CVE-2018-6596 is a vulnerability of currently unknown severity. webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events.. EPSS estimates a 2.66% chance of exploitation in the next 30 days.

Description

webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which allows remote attackers to post arbitrary e-mail tracking events.

Metrics

EPSS Probability

2.66%

83.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-200

Affected Software

Vendor	Product	Versions
Django-Anymail Project	Django-Anymail	< 1.2.1
Debian	Debian Linux	9.0

References

https://bugs.debian.org/889450Issue Tracking, Patch, Third Party Advisory
https://github.com/anymail/django-anymail/commit/c07998304b4a31df4c61deddcb03d3607a04691bPatch
https://github.com/anymail/django-anymail/commit/db586ede1fbb41dce21310ea28ae15a1cf1286c5Patch
https://github.com/anymail/django-anymail/releases/tag/v1.2.1Release Notes
https://github.com/anymail/django-anymail/releases/tag/v1.3Release Notes
https://www.debian.org/security/2018/dsa-4107Third Party Advisory
https://bugs.debian.org/889450Issue Tracking, Patch, Third Party Advisory
https://github.com/anymail/django-anymail/commit/c07998304b4a31df4c61deddcb03d3607a04691bPatch
https://github.com/anymail/django-anymail/commit/db586ede1fbb41dce21310ea28ae15a1cf1286c5Patch
https://github.com/anymail/django-anymail/releases/tag/v1.2.1Release Notes
https://github.com/anymail/django-anymail/releases/tag/v1.3Release Notes
https://www.debian.org/security/2018/dsa-4107Third Party Advisory

Timeline

Published: Feb 3, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-6596?

How severe is CVE-2018-6596?

Severity scoring for CVE-2018-6596 is pending analysis. The EPSS model estimates a 2.66% probability of exploitation in the next 30 days.

How do I fix CVE-2018-6596?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-6596?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST