CVE-2013-1895
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2013-1895
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2013-1895.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2013-1895
- Aliases
- Related
- Published
- 2020-01-28T15:15:14Z
- Modified
- 2024-09-11T02:00:06Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.
- References
-
- http://www.securityfocus.com/bid/58702
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83039
- http://www.openwall.com/lists/oss-security/2013/03/26/2
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html
- https://security-tracker.debian.org/tracker/CVE-2013-1895
Affected packages
Debian:11 / python-bcrypt
Package
- Name
- python-bcrypt
- Purl
- pkg:deb/debian/python-bcrypt?arch=source
Debian:12 / python-bcrypt
Package
- Name
- python-bcrypt
- Purl
- pkg:deb/debian/python-bcrypt?arch=source
Debian:13 / python-bcrypt
Package
- Name
- python-bcrypt
- Purl
- pkg:deb/debian/python-bcrypt?arch=source