CVE-2013-1895: High severity python3-bcrypt vulnerability
Published Jan 28, 2020
·Updated
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.
Affected Software
4 affected componentsFixes available
pip/py-bcrypt<0.3
0.3
Python py-bcrypt<0.3
Fedoraproject Fedora=17
Fedoraproject Fedora=18
Event History
Jan 28, 2020
CVE Published
via MITRE·02:30 PM
Data Sourced
via MITRE·02:30 PM
DescriptionWeakness
Data Sourced
via NVD·03:15 PM
DescriptionSeverityWeaknessAffected Software
Oct 12, 2021
Advisory Published
via GitHub·04:31 PM
Frequently Asked Questions
1
What is the severity of CVE-2013-1895?
CVE-2013-1895 has a medium severity due to its potential to allow attackers to bypass authentication.
2
How do I fix CVE-2013-1895?
To fix CVE-2013-1895, upgrade the py-bcrypt module to version 0.3 or later.
3
Which versions of py-bcrypt are affected by CVE-2013-1895?
CVE-2013-1895 affects all versions of py-bcrypt prior to 0.3.
4
Can CVE-2013-1895 lead to unauthorized access?
Yes, CVE-2013-1895 can lead to unauthorized access through multiple concurrent authentication requests.
5
What software systems are impacted by CVE-2013-1895?
CVE-2013-1895 impacts systems using py-bcrypt versions below 0.3, including specific Fedora releases.