PYSEC-2020-249
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/py-bcrypt/PYSEC-2020-249.yaml
- JSON Data
- https://api.test.osv.dev/v1/vulns/PYSEC-2020-249
- Aliases
- Published
- 2020-01-28T15:15:00Z
- Modified
- 2023-11-01T04:45:01.583322Z
- Summary
- [none]
- Details
-
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.
- References
-
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83039
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html
- http://www.openwall.com/lists/oss-security/2013/03/26/2
- http://www.securityfocus.com/bid/58702
- https://github.com/advisories/GHSA-r838-q6jp-58xx
Affected packages
PyPI / py-bcrypt
Package
- Name
- py-bcrypt
- View open source insights on deps.dev
- Purl
- pkg:pypi/py-bcrypt