0x-web3 (5.0.0a5), aea (>=0.1.13, <=0.5.4) +49 more potentially affected by CVE-2021-33880 via websockets (7.0.0)

websockets PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - 0x-web3 5.0.0a5 - aea =0.1.13, =3.1.0, =0.1.0, =0.3.1, =3.1.0, =0.2.0, =0.3.0, =0.0.16, =0.1.0, =0.1.0, =0.0.1, =0.14.0, =0.14.1 and more...

aiotruenas-client (0.6.0), arcor2 (0.16.0) +8 more potentially affected by CVE-2021-33880 via websockets (>=9.0.1, <=9.0.2)

websockets PYPI version =9.0.1, =1.0.0, =1.0.7 Source cves: CVE-2021-33880 Source advisory: OSV:PYSEC-2021-95...

gabriel-client (>=0.0.4, <=2.0.2), gabriel-server (>=0.1.0, <=2.0.2) +2 more potentially affected by CVE-2021-33880 via websockets (8.0.0)

websockets PYPI version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - gabriel-client =0.0.4, =0.1.0, =0.0.12, =0.0.3, =0.0.4 Source cves: CVE-2021-33880 Source advisory: OSV:PYSEC-2021-95...

bonsai-python (>=0.2.1, <=0.4.0), discord-py-legacy (0.16.13) +6 more potentially affected by CVE-2021-33880 via websockets (3.4.0)

websockets PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - bonsai-python =0.2.1, =0.17.0b1, =0.1.3, =1.0.0, =2.0.1 - textxls 1.1.0 Source cves: CVE-2021-33880 Source advisory: OSV:PYSEC-2021-95...

inmation-api-client (>=0.2.0, <=0.2.1), purly (>=0.2.0, <=0.2.1.dev4) potentially affected by CVE-2021-33880 via websockets (5.0.0)

websockets PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - inmation-api-client =0.2.0, =0.2.0, =0.2.1.dev4 Source cves: CVE-2021-33880 Source advisory: OSV:PYSEC-2021-95...

0x-order-utils (>=1.0.2, <=1.1.1), 0x-web3 (>=4.7.1, <=4.8.2.1) +109 more potentially affected by CVE-2021-33880 via websockets (6.0.0)

websockets PYPI version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - 0x-order-utils =1.0.2, =4.7.1, =1.0.0b31, =0.1.5, =1.2.3a1, =0.15.0.0, =0.2.2, =0.1.14, =0.39.0, =0.1.0, =0.1.3, =3.0.0rc3, =0.0.1, =1.0.1,...

3di-cmd-client (>=0.0.1a0, <=0.0.3), aea (>=0.6.0, <=0.10.1) +444 more potentially affected by CVE-2021-33880 via websockets (8.1.0)

websockets PYPI version 8.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - 3di-cmd-client =0.0.1a0, =0.6.0, =0.1.0, =1.1.5, =1.0.1, =0.1.0, =0.1.0, =0.9.2, =0.1.0, =0.1.0, =0.1.0, =0.9.0, =0.49.0, =1.2.1 and more...

PYSEC-2021-95

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactorycredentials=.... An attacker may be able to guess a password via a timing attack...

PYSEC-2021-95

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactorycredentials=.... An attacker may be able to guess a password via a timing attack...

discord-py-unofficial (>=0.17.0b4, <=0.17.0b5), missinglinkai-resource-manager-docker (>=1.3.457, <=2.1.914) +6 more potentially affected by CVE-2021-33880 via websockets (4.0.1)

websockets PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - discord-py-unofficial =0.17.0b4, =1.3.457, =0.2.0a28, =0.0.4, =0.1.0a12, =0.1.0a13 - web3 4.3.0 Source cves: CVE-2021-33880 Source advisory:...

aio-kraken-ws (>=0.0.1, <=0.3.9), bitpanda-aio (>=0.0.1, <=0.1.1) +16 more potentially affected by CVE-2021-33880 via websockets (8.0.2)

websockets PYPI version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - aio-kraken-ws =0.0.1, =0.0.1, =0.3.3, =1.0.0, =1.5.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.1.2, =0.4.1, =5.0.0a72, =0.0.2, =0.0.1.dev1,...

chromewhip (>=0.2.2, <=0.2.16), gdax-python-api (0.1.0) +3 more potentially affected by CVE-2021-33880 via websockets (3.3.0)

websockets PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - chromewhip =0.2.2, =0.2.16 - gdax-python-api 0.1.0 - pyvesteltv 0.1.1 - qcodes 0.1.9 - theia 0.9.1 Source cves: CVE-2021-33880 Source...

anomalydetection (0.0.0.dev1), ccxt (1.17.1) +30 more potentially affected by CVE-2021-33880 via websockets (5.0.1)

websockets PYPI version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on websockets and may be impacted: - anomalydetection 0.0.0.dev1 - ccxt 1.17.1 - contracts-lib-py 0.2.0 - django-ethereum-events 1.0.5 - entrance =0.0.1, =0.1.1a2, =2.1.1,...

CVE-2021-33880

The CVE-2021-33880 issue affects the aaugustin websockets library for Python, before version 9.1. It describes an Observable Timing Discrepancy when HTTP Basic Authentication is enabled (basic_auth_protocol_factory(credentials=...)), allowing an attacker to guess passwords via a timing attack. A ...

CVE-2021-33880

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactorycredentials=.... An attacker may be able to guess a password via a timing attack...

CVE-2021-33880

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactorycredentials=.... An attacker may be able to guess a password via a timing attack...

0x-order-utils (>=1.0.2, <=1.1.1), 0x-web3 (>=4.7.1, <=5.0.0a5) +608 more potentially affected by CVE-2021-33880 via websockets (>=2.0.0, <=9.0.2)

websockets PYPI version =2.0.0, =1.0.2, =4.7.1, =0.0.1a0, =1.0.0b31, =0.1.13, =0.1.0, =3.1.0, =0.1.5, =1.1.5, =0.0.1, =1.0.1, =1.2.3a1, =0.1.0, =0.1.0, =0.1.0, =0.1.3 and more Source cves: CVE-2021-33880 Source advisory: MEND:CVE-2021-33880...

CVE-2021-33880

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactorycredentials=.... An attacker may be able to guess a password via a timing attack...

Python security vulnerabilities

Python is an open source, object-oriented programming language from the Python Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. A security vulnerability exists in Python's aaugustin websockets library prior to 9.1, which stems from an...

CVE-2021-33880: Observable Discrepancy

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basicauthprotocolfactorycredentials=.... An attacker may be able to guess a password via a timing attack...