CVEvulnerability
CVE-2013-1895
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-01-28
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-307
Description
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.
Affected configurations
• python py-bcrypt (< 0.3)
• fedoraproject fedora 17
• fedoraproject fedora 18
Related
Weakness · CWE (1)
- CWE-307 Improper Restriction of Excessive Authentication Attempts weakness
References
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html Third Party Advisory, Tool Signature
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/03/26/2 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/58702 Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83039 Third Party Advisory, VDB Entry
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html Third Party Advisory, Tool Signature
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/03/26/2 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/58702 Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83039 Third Party Advisory, VDB Entry