CVE-2021-33880

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2021-33880 python-websockets Corrigé dans: 9.1-1
Ubuntu UBUNTU-CVE-2021-33880 python-websockets

Références

patch github.com
patch oracle.com
patch oracle.com