Arch Linux Security Advisory ASA-202106-26

Severity: Medium
Date : 2021-06-09
CVE-ID : CVE-2021-33880
Package : python-websockets
Type : private key recovery
Remote : Yes
Link : https://security.archlinux.org/AVG-2040

Summary

The package python-websockets before version 9.1-1 is vulnerable to
private key recovery.

Resolution

Upgrade to 9.1-1.

pacman -Syu “python-websockets>=9.1-1”

The problem has been fixed upstream in version 9.1.

Workaround

None.

Description

The aaugustin websockets library before 9.1 for Python has an
observable timing discrepancy on servers when HTTP Basic Authentication
is enabled with basic_auth_protocol_factory(credentials=…). An
attacker may be able to guess a password via a timing attack.

Impact

A remote attacker could guess HTTP Basic Authentication passwords using
a timing attack.

References

https://github.com/aaugustin/websockets/commit/547a26b685d08cac0aa64e5e65f7867ac0ea9bc0
https://security.archlinux.org/CVE-2021-33880