Stay Secure with the Latest Linux Advisories

security advisoryprivate keymedium severity

Arch Linux ASA-202106-26 Medium: Python-Websockets Private Key Leak

The package python-websockets before version 9.1-1 is vulnerable to private key recovery. . Arch Linux Security Advisory ASA-202106-26 ========================================= Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-33880 Package : python-websockets Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-2040 Summary ====== The package python-websockets before version 9.1-1 is vulnerable to private key recovery. Resolution ========= Upgrade to 9.1-1. # pacman -Syu "python-websockets> =9.1-1" The problem has been fixed upstream in version 9.1. Workaround ========= None. Description ========== The aaugustin websockets library before 9.1 for Python has an observable timing discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack. Impact ===== A remote attacker could guess HTTP Basic Authentication passwords using a timing attack. References ========= https://github.com/python-websockets/websockets/commit/547a26b685d08cac0aa64e5e65f7867ac0ea9bc0 https://security.archlinux.org/CVE-2021-33880 . The Arch Linux Security Advisory ASA-202106-27 informs users about a moderate severity vulnerability in python-httpx that may lead to information disclosure.. Arch Linux, Python Websockets, Security Advisory, Private Key Recovery, Medium Severity Issue. . Severity: Medium. LinuxSecurity.com Team

Jun 11, 2021 •Medium ArchLinux