GitHub Advisoryadvisory · PyPI
GHSA-r838-q6jp-58xx Improper Restriction of Excessive Authentication Attempts in py-bcrypt
HIGH
Official page ↗
- Aliases
- CVE-2013-1895
- Ecosystem
- PyPI
- Packages
- py-bcrypt
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-307
- Reviewed
- 2021-10-08
Affected packages
• PyPI py-bcrypt: < 0.3 → fixed in 0.3
Description
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.
Related
Alias · CVE (1)
- CVE-2013-1895 The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass… vulnerability
Weakness · CWE (1)
- CWE-307 Improper Restriction of Excessive Authentication Attempts weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-1895 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83039 web
- https://github.com/advisories/GHSA-r838-q6jp-58xx advisory
- https://github.com/grnet/python-bcrypt package
- https://github.com/pypa/advisory-database/tree/main/vulns/py-bcrypt/PYSEC-2020-249.yaml web
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html web
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html web
- http://www.openwall.com/lists/oss-security/2013/03/26/2 web