CVE-2021-33880

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.

Published: Jun 6, 2021
Updated: May 9, 2024
CVE: CVE-2021-33880
GHSA: GHSA-8ch4-58qp-g3mp
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 5.9
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

Severity: Low
Score: 2.6
AV:N/AC:H/Au:N/C:P/I:N/A:N

CWEs:

CWE-203
CWE-208

Affected Software
References

Software	From	Fixed in
websockets_project / websockets	-	9.1
oracle / communications_cloud_native_core_policy	1.14.0	1.14.0.x
oracle / communications_cloud_native_core_unified_data_repository	1.14.0	1.14.0.x
oracle / communications_cloud_native_core_service_communication_proxy	1.14.0	1.14.0.x
oracle / communications_cloud_native_core_security_edge_protection_proxy	1.5.0	1.5.0.x
websockets	-	9.1

https://github.com/aaugustin/websockets/commit/547a26b685d08cac0aa64e5e65f7867ac0ea9bc0
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujan2022.html

Vulnerability Database

289,599

CVE-2021-33880