PT-2021-4278 · Unknown · Aaugustin Websockets
Published
2021-06-06
·
Updated
2022-05-12
·
CVE-2021-33880
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
aaugustin websockets library versions prior to 9.1
Description
The issue is related to an Observable Timing Discrepancy in the aaugustin websockets library when HTTP Basic Authentication is enabled using
basic auth protocol factory(credentials=...). This discrepancy may allow an attacker to guess a password via a timing attack, potentially leading to unauthorized access to confidential data.Recommendations
For versions prior to 9.1, update to version 9.1 or later to resolve the issue. As a temporary workaround, consider disabling the
basic auth protocol factory function with credentials parameter until a patch is available. Restrict access to the basic auth protocol factory function to minimize the risk of exploitation. Avoid using the credentials parameter in the affected authentication endpoint until the issue is resolved.Fix
Side Channel Attack
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Aaugustin Websockets