CVE-2021-33880

Published: Jun 6, 2021Modified: Nov 21, 2024

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.

Affected (5)

Products: Websockets Project: Websockets · Oracle: Communications Cloud Native Core Policy, Communications Cloud Native Core Security Edge Protection Proxy, Communications Cloud Native Core Service Communication Proxy, Communications Cloud Native Core Unified Data Repository

Websockets Project

1 product

Websockets

Oracle

4 products

Communications Cloud Native Core Policy

Communications Cloud Native Core Security Edge Protection Proxy

Communications Cloud Native Core Service Communication Proxy

Communications Cloud Native Core Unified Data Repository

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Websockets Project Websockets	Before 9.1

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Cloud Native Core Policy	Version 1.14.0
Oracle Communications Cloud Native Core Security Edge Protection Proxy	Version 1.5.0
Oracle Communications Cloud Native Core Service Communication Proxy	Version 1.14.0
Oracle Communications Cloud Native Core Unified Data Repository	Version 1.14.0