Описание
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| python-websockets | fixed | 9.1-1 | package | |
| python-websockets | fixed | 8.1-1+deb11u1 | bullseye | package |
| python-websockets | not-affected | buster | package | |
| python-websockets | not-affected | stretch | package |
Примечания
https://github.com/aaugustin/websockets/commit/547a26b685d08cac0aa64e5e65f7867ac0ea9bc0
Связанные уязвимости
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
Observable Timing Discrepancy in aaugustin websockets library
Уязвимость библиотеки aaugustin протокола связи websockets языка программирования Python, связанная с утечкой информации на основании временных расхождений, позволяющая нарушителю получить доступ к конфиденциальным данным