debian/python-websockets vulnerabilities

Latest debian/python-websockets CVEs

Newest publication first

1. CVE-2021-33880 Observable Timing Discrepancy in aaugustin websockets library

   Published 2021-06-06

   Medium·CVSS 5.9 EPSS 2.3%

   The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.