CVE-2021-33880
06.06.2021, 15:15
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.Enginsight
| Vendor | Product | Version |
|---|---|---|
| websockets_project | websockets | 𝑥 < 9.1 |
| oracle | communications_cloud_native_core_policy | 1.14.0 |
| oracle | communications_cloud_native_core_security_edge_protection_proxy | 1.5.0 |
| oracle | communications_cloud_native_core_service_communication_proxy | 1.14.0 |
| oracle | communications_cloud_native_core_unified_data_repository | 1.14.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References