CVE search · CVE-2013-1895
CVE-2013-1895
high 7.5
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.
Details
- Status
- Modified
- Published
- Last changed
- Source
- secalert@redhat.com
- Weakness
- CWE-307
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | high 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
nvd@nist.govPrimary |
| CVSS 2.0 | medium 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
- python · py-bcrypt
- fedoraproject · fedora
References
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.htmlThird Party AdvisoryTool Signature
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.htmlThird Party Advisory
- http://www.openwall.com/lists/oss-security/2013/03/26/2Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/58702Third Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83039Third Party AdvisoryVDB Entry
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.htmlThird Party AdvisoryTool Signature
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.htmlThird Party Advisory
- http://www.openwall.com/lists/oss-security/2013/03/26/2Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/58702Third Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/83039Third Party AdvisoryVDB Entry