CVE-2021-33880

Katalog CVE

CVSS 5.9 · Medium EPSS 2,3%

Kerentanan Observable Discrepancy pada websockets project websockets, oracle communications cloud native core policy +3 lainnya. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.

Rincian

Terbit di NVD

6 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-203: Observable Discrepancy

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/aaugustin/websockets/commit/547a26b685d08cac0aa64e5e65f7867ac0ea9bc0 patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga