Timing Attack Vulnerability in Python Websockets Library
Summary
CVE-2021-33880: The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). Affects python-websockets across 3 version ranges.
< 8.1-1+deb11u1
< 547a26b685d08cac0aa64e5e65f7867ac0ea9bc0
< d0f328888f3e695aa64d78dcf48af4ece219221b
Fixed in 8.1-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Python Websockets library, developed by aaugustin, facilitates real-time communication between clients and servers using the WebSocket protocol. It is widely used in applications that require persistent connections, such as chat applications and live notifications. However, a vulnerability exists in versions prior to 9.1 that allows attackers to exploit timing discrepancies when HTTP Basic Authentication is enabled.
Vulnerability Detail
The vulnerability, identified as CVE-2021-33880, arises from an observable timing discrepancy in the authentication process of the Python Websockets library. When HTTP Basic Authentication is enabled, an attacker can potentially exploit this timing issue to guess passwords through a timing attack. This could lead to unauthorized access to sensitive information or systems, making it critical for users of affected versions to address this vulnerability promptly.
How To Fix
Minimum fixed version
8.1-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-websocketsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable HTTP Basic Authentication if possible, or implement additional security measures such as rate limiting and monitoring for unusual login attempts to mitigate the risk of timing attacks.
Conclusion
The CVE-2021-33880 vulnerability in the Python Websockets library poses a significant risk due to its potential for exploitation through timing attacks. Users are strongly advised to upgrade to the latest version of the library to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for python-websockets →
FAQ
CVE-2021-33880 is a vulnerability in the Python Websockets library that allows attackers to exploit timing discrepancies in HTTP Basic Authentication.
Versions prior to 9.1 are affected by this vulnerability.
If left unaddressed, attackers may gain unauthorized access to systems by guessing passwords through timing attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.9, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for python-websockets.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
