high7.5
CVE-2013-1895
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple auth…
Impact
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Python | Py-Bcrypt | before 0.3 |
| Fedoraproject | Fedora | Versions 17, 18 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html
- http://www.openwall.com/lists/oss-security/2013/03/26/2
- http://www.securityfocus.com/bid/58702
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83039
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html
- http://www.openwall.com/lists/oss-security/2013/03/26/2
- http://www.securityfocus.com/bid/58702
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83039