PYSEC-2021-95

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/websockets/PYSEC-2021-95.yaml

JSON Data

https://api.test.osv.dev/v1/vulns/PYSEC-2021-95

Aliases

Published

2021-06-06T15:15:00Z

Modified

2023-11-01T04:55:37.056203Z

Summary

[none]

Details

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.

References

Affected packages

PyPI / websockets

Package

Name: websockets; View open source insights on deps.dev
Purl: pkg:pypi/websockets

Affected ranges

Type: GIT
Repo: https://github.com/aaugustin/websockets
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

547a26b685d08cac0aa64e5e65f7867ac0ea9bc0

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.1

Affected versions

0.*

0.1

1.*

1.0

2.*

2.0

2.1

2.2

2.3

2.4

2.5

2.6

2.7

3.*

3.0

3.1

3.2

3.3

3.4

4.*

4.0

4.0.1

5.*

5.0

5.0.1

6.*

6.0

7.*

7.0

8.*

8.0

8.0.1

8.0.2

8.1

9.*

9.0

9.0.1

9.0.2