CVE-2021-33880

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with...

Original description

The description as published by the source.

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2021-33880 python-websockets Fixed in: 9.1-1
Ubuntu UBUNTU-CVE-2021-33880 python-websockets

References

patch github.com
patch oracle.com
patch oracle.com