high5.9
CVE-2021-33880
Observable Timing Discrepancy in aaugustin websockets library
Impact
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | websockets | < 9.1 | 9.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Websockets Project | Websockets | before 9.1 |
| Oracle | Communications Cloud Native Core Policy | Version 1.14.0 |
| Oracle | Communications Cloud Native Core Security Edge Protection Proxy | Version 1.5.0 |
| Oracle | Communications Cloud Native Core Service Communication Proxy | Version 1.14.0 |
| Oracle | Communications Cloud Native Core Unified Data Repository | Version 1.14.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/aaugustin/websockets/commit/547a26b685d08cac0aa64e5e65f7867ac0ea9bc0
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://github.com/advisories/GHSA-8ch4-58qp-g3mp
- https://nvd.nist.gov/vuln/detail/CVE-2021-33880
- https://github.com/pypa/advisory-database/tree/main/vulns/websockets/PYSEC-2021-95.yaml