Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2021-33880 →
DEBIAN-CVE-2021-33880
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:12
python-websockets
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-1"}]}]
Debian:13
python-websockets
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-1"}]}]
Debian:14
python-websockets
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-1"}]}]
Références
- advisory security-tracker.debian.org