Vulnerability CVE-2013-1895
Published: 2020-01-28

Description:
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.

Type:

CWE-307

 (Improper Restriction of Excessive Authentication Attempts)

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Python -> Py-bcrypt 
Fedoraproject -> Fedora 

 References:
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html
http://www.openwall.com/lists/oss-security/2013/03/26/2
http://www.securityfocus.com/bid/58702
https://exchange.xforce.ibmcloud.com/vulnerabilities/83039
Copyright 2024, cxsecurity.com

 

Back to Top