CVE-2013-1895

Published: Jan 28, 2020Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.

Affected (3)

Products: Python: Py Bcrypt · Fedoraproject: Fedora

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Python Py Bcrypt	Before 0.3

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 17
Fedoraproject Fedora	Version 18

Related CWEs

CWE-307

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (10)

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html

Source: secalert@redhat.com

Third Party AdvisoryTool Signature

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html

Source: secalert@redhat.com

Third Party Advisory

http://www.openwall.com/lists/oss-security/2013/03/26/2

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/58702

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/83039

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html