CVE-2021-33880: Medium severity websockets project websockets (python) vulnerability
Published Jun 6, 2021
·Updated
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactory(credentials=...). An attacker may be able to guess a password via a timing attack.
Affected Software
6 affected componentsFixes available
pip/websockets<9.1
9.1
Websockets Project Websockets Python<9.1
Oracle Communications Cloud Native Core Policy=1.14.0
Oracle Communications Cloud Native Core Security Edge Protection Proxy=1.5.0
Oracle Communications Cloud Native Core Service Communication Proxy=1.14.0
Oracle Communications Cloud Native Core Unified Data Repository=1.14.0
Remediation
Patch Available
Patch Available
Event History
Jun 6, 2021
CVE Published
via MITRE·02:05 PM
Data Sourced
via MITRE·02:05 PM
Description
Jun 11, 2021
Advisory Published
via GitHub·05:43 PM
Frequently Asked Questions
1
What is the severity of CVE-2021-33880?
The severity of CVE-2021-33880 is medium.
2
How does CVE-2021-33880 affect the aaugustin websockets library?
CVE-2021-33880 affects the aaugustin websockets library version up to 9.1.
3
What is the vulnerability in CVE-2021-33880?
The vulnerability in CVE-2021-33880 is an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory.
4
How can an attacker exploit CVE-2021-33880?
An attacker can exploit CVE-2021-33880 by guessing a password via a timing attack.
5
Are there any fixes or patches available for CVE-2021-33880?
Yes, fixes are available for CVE-2021-33880. Please refer to the references for more information.