ArchLinux: 202106-26: python-websockets: private key recovery | Lin...
Arch Linux Security Advisory ASA-202106-26
==========================================

Severity: Medium
Date    : 2021-06-09
CVE-ID  : CVE-2021-33880
Package : python-websockets
Type    : private key recovery
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2040

Summary
=======

The package python-websockets before version 9.1-1 is vulnerable to
private key recovery.

Resolution
==========

Upgrade to 9.1-1.

# pacman -Syu "python-websockets>=9.1-1"

The problem has been fixed upstream in version 9.1.

Workaround
==========

None.

Description
===========

The aaugustin websockets library before 9.1 for Python has an
observable timing discrepancy on servers when HTTP Basic Authentication
is enabled with basic_auth_protocol_factory(credentials=...). An
attacker may be able to guess a password via a timing attack.

Impact
======

A remote attacker could guess HTTP Basic Authentication passwords using
a timing attack.

References
==========

https://github.com/aaugustin/websockets/commit/547a26b685d08cac0aa64e5e65f7867ac0ea9bc0
https://security.archlinux.org/CVE-2021-33880

ArchLinux: 202106-26: python-websockets: private key recovery

June 11, 2021
The package python-websockets before version 9.1-1 is vulnerable to private key recovery

Summary

The aaugustin websockets library before 9.1 for Python has an observable timing discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.

Resolution

Upgrade to 9.1-1.
# pacman -Syu "python-websockets>=9.1-1"
The problem has been fixed upstream in version 9.1.

References

https://github.com/aaugustin/websockets/commit/547a26b685d08cac0aa64e5e65f7867ac0ea9bc0 https://security.archlinux.org/CVE-2021-33880

Severity
CVE-ID : CVE-2021-33880
Package : python-websockets
Type : private key recovery
Remote : Yes
Link : https://security.archlinux.org/AVG-2040

Impact

A remote attacker could guess HTTP Basic Authentication passwords using a timing attack.

Workaround

None.

Related News

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.