PYSEC-2021-95

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/websockets/PYSEC-2021-95.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2021-95
Aliases
Published
2021-06-06T15:15:00Z
Modified
2023-11-08T04:06:06.475813Z
Summary
[none]
Details

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.

References

Affected packages

PyPI / websockets

Package

Name
websockets
View open source insights on deps.dev
Purl
pkg:pypi/websockets

Affected ranges

Type
GIT
Repo
https://github.com/aaugustin/websockets
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
547a26b685d08cac0aa64e5e65f7867ac0ea9bc0
Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.1

Affected versions

0.*
0.1
1.*
1.0
2.*
2.0
2.1
2.2
2.3
2.4
2.5
2.6
2.7
3.*
3.0
3.1
3.2
3.3
3.4
4.*
4.0
4.0.1
5.*
5.0
5.0.1
6.*
6.0
7.*
7.0
8.*
8.0
8.0.1
8.0.2
8.1
9.*
9.0
9.0.1
9.0.2

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/websockets/PYSEC-2021-95.yaml"