| Package | Affected versions | Patched versions |
|---|---|---|
| websockets | < 9.1 | 9.1 |
| communications cloud native core policy | = 1.14.0 | |
| communications cloud native core security edge protection proxy | = 1.5.0 | |
| communications cloud native core service communication proxy | = 1.14.0 | |
| communications cloud native core unified data repository | = 1.14.0 | |
| websockets | < 9.1 | 9.1 |
The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free