aiotruenas-client (0.6.0), arcor2 (0.16.0) +8 more potentially affected by CVE-2021-33880 via websockets (>=9.0.1, <=9.0.2)

websockets PYPI version =9.0.1, =1.0.0, =1.0.7 Source cves: CVE-2021-33880 Source advisory: GHSA-8CH4-58QP-G3MP...

Observable Timing Discrepancy in aaugustin websockets library

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactorycredentials=.... An attacker may be able to guess a password via a timing attack...

inmation-api-client (>=0.2.0, <=0.2.1), purly (>=0.2.0, <=0.2.1.dev4) potentially affected by CVE-2021-33880 via websockets (5.0.0)

websockets PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - inmation-api-client =0.2.0, =0.2.0, =0.2.1.dev4 Source cves: CVE-2021-33880 Source advisory: OSV:GHSA-8CH4-58QP-G3MP...

0x-web3 (5.0.0a5), aea (>=0.1.13, <=0.5.4) +49 more potentially affected by CVE-2021-33880 via websockets (7.0.0)

websockets PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - 0x-web3 5.0.0a5 - aea =0.1.13, =3.1.0, =0.1.0, =0.3.1, =3.1.0, =0.2.0, =0.3.0, =0.0.16, =0.1.0, =0.1.0, =0.0.1, =0.14.0, =0.14.1 and more...

bitshares (>=0.1.0, <=0.1.5), geoffrey (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2021-33880 via websockets (2.0.0)

websockets PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - bitshares =0.1.0, =0.1.0, =0.1.1 - golos 0.2.3 - uptick 0.1.2 Source cves: CVE-2021-33880 Source advisory: OSV:GHSA-8CH4-58QP-G3MP...

gabriel-client (>=0.0.4, <=2.0.2), gabriel-server (>=0.1.0, <=2.0.2) +2 more potentially affected by CVE-2021-33880 via websockets (8.0.0)

websockets PYPI version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - gabriel-client =0.0.4, =0.1.0, =0.0.12, =0.0.3, =0.0.4 Source cves: CVE-2021-33880 Source advisory: OSV:GHSA-8CH4-58QP-G3MP...

chromewhip (>=0.2.2, <=0.2.16), gdax-python-api (0.1.0) +3 more potentially affected by CVE-2021-33880 via websockets (3.3.0)

websockets PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - chromewhip =0.2.2, =0.2.16 - gdax-python-api 0.1.0 - pyvesteltv 0.1.1 - qcodes 0.1.9 - theia 0.9.1 Source cves: CVE-2021-33880 Source...

GHSA-8CH4-58QP-G3MP Observable Timing Discrepancy in aaugustin websockets library

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactorycredentials=.... An attacker may be able to guess a password via a timing attack...

aio-kraken-ws (>=0.0.1, <=0.3.9), bitpanda-aio (>=0.0.1, <=0.1.1) +16 more potentially affected by CVE-2021-33880 via websockets (8.0.2)

websockets PYPI version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - aio-kraken-ws =0.0.1, =0.0.1, =0.3.3, =1.0.0, =1.5.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.1.2, =0.4.1, =5.0.0a72, =0.0.2, =0.0.1.dev1,...

0x-order-utils (>=1.0.2, <=1.1.1), 0x-web3 (>=4.7.1, <=4.8.2.1) +109 more potentially affected by CVE-2021-33880 via websockets (6.0.0)

websockets PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - 0x-order-utils =1.0.2, =4.7.1, =1.0.0b31, =0.1.5, =1.2.3a1, =0.15.0.0, =0.2.2, =0.1.14, =0.39.0, =0.1.0, =0.1.3, =3.0.0rc3, =0.0.1, =1.0.1,...

[ASA-202106-26] python-websockets: private key recovery

Arch Linux Security Advisory ASA-202106-26 ========================================== Severity: Medium Date : 2021-06-09 CVE-ID : CVE-2021-33880 Package : python-websockets Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-2040 Summary ======= The package...

Information Disclosure

websockets is vulnerable to information disclosure. The vulnerability exists due to an observable timing discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactory, allowing an attacker to guess a password via timing attack...

CVE-2021-33880

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactorycredentials=.... An attacker may be able to guess a password via a timing attack...

DEBIAN-CVE-2021-33880

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactorycredentials=.... An attacker may be able to guess a password via a timing attack...

CVE-2021-33880

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactorycredentials=.... An attacker may be able to guess a password via a timing attack...

bitshares (>=0.1.0, <=0.1.5), geoffrey (>=0.1.0, <=0.1.1) +2 more potentially affected by CVE-2021-33880 via websockets (2.0.0)

websockets PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - bitshares =0.1.0, =0.1.0, =0.1.1 - golos 0.2.3 - uptick 0.1.2 Source cves: CVE-2021-33880 Source advisory: OSV:PYSEC-2021-95...

django-private-chat (>=0.1.0, <=0.2.2) potentially affected by CVE-2021-33880 via websockets (3.2.0)

websockets PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - django-private-chat =0.1.0, =0.2.2 Source cves: CVE-2021-33880 Source advisory: OSV:PYSEC-2021-95...

UBUNTU-CVE-2021-33880

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactorycredentials=.... An attacker may be able to guess a password via a timing attack...

CVE-2021-33880

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactorycredentials=.... An attacker may be able to guess a password via a timing attack...

geoffrey (0.1.2) potentially affected by CVE-2021-33880 via websockets (2.1.0)

websockets PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - geoffrey 0.1.2 Source cves: CVE-2021-33880 Source advisory: OSV:PYSEC-2021-95...