CVE-2013-1895 Improper Restriction of Excessive Authentication Attempts in py-bcrypt
HighCVSS 7.5
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi py-bcrypt(PyPI) | < 0.3 | 0.3 |
| pypi py-bcrypt(PyPI) | = 0.1 | No fix listed |
| pypi py-bcrypt(PyPI) | = 0.2 | No fix listed |
| debian/python-bcrypt(Debian:12) | < 0.4-1 | 0.4-1 |
| debian/python-bcrypt(Debian:13) | < 0.4-1 | 0.4-1 |
| debian/python-bcrypt(Debian:14) | < 0.4-1 | 0.4-1 |
| python py-bcrypt | < 0.3 | 0.3 |
| fedoraproject fedora | = 17 | No fix listed |
| fedoraproject fedora | = 18 | No fix listed |
| py-bcrypt | = before 0.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- exchange.xforce.ibmcloud.com third-party-advisory vdb-entry
- github.com vendor-advisory
- github.com product
- github.com
- lists.fedoraproject.org third-party-advisory tool-signature
- lists.fedoraproject.org third-party-advisory
- www.openwall.com mailing-list third-party-advisory
- www.securityfocus.com third-party-advisory vdb-entry
- Debian Security Tracker CVE-2013-1895 vendor-advisory
- bugs.debian.org issue-tracking