VDB
CVE-2021-33880
CVE-2021-33880
PUBLISHED
CVSS 5.900000095367432 MEDIUM
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
EPSS 2.26% · 83.0th percentile
Risk Scores
CVSS 3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
2.26%
83.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | python-websockets | 2.6-1, 0, 3.0-1 |
| Ubuntu:24.04:LTS | python-websockets | 10.4-1, 0 |
| Ubuntu:20.04:LTS | python-websockets | 7.0-1, 8.1-1, 0 |
| Ubuntu:22.04:LTS | python-websockets | 9.1-1, 8.1-1, 0 |
| Ubuntu:25.10 | python-websockets | 15.0.1-1, 0, 14.1-1build1 |
| Ubuntu:18.04:LTS | python-websockets | 0, 3.4-1, 3.3-1 |
Timeline
- Jun 6, 2021 CVE Published
- Jun 8, 2021 EPSS Score
- Jun 19, 2021 EPSS Score
- Aug 9, 2021 EPSS Score
- Oct 10, 2021 EPSS Score
- Dec 10, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 9, 2022 EPSS Score
- Feb 10, 2022 EPSS Score
- Apr 12, 2022 EPSS Score
- Jun 12, 2022 EPSS Score
- Aug 13, 2022 EPSS Score