Timing Attack Vulnerability in Python Websockets Package
Summary
DEBIAN-CVE-2021-33880: The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). Affects python-websockets versions < 8.1-1+deb11u1. Fixed in 8.1-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Python Websockets package is a popular library used for building WebSocket servers and clients in Python. It provides an easy-to-use interface for real-time communication between clients and servers. The library is widely utilized in applications requiring persistent connections, such as chat applications and live data feeds. However, a vulnerability has been identified in versions prior to 9.1, which exposes users to potential timing attacks when HTTP Basic Authentication is enabled.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2021-33880, arises from an Observable Timing Discrepancy in the aaugustin websockets library before version 9.1. When HTTP Basic Authentication is enabled with the basic_auth_protocol_factory(credentials=...) function, an attacker may exploit this timing discrepancy to guess passwords through a timing attack. This could lead to unauthorized access to sensitive information and compromise the security of the application.
How To Fix
Minimum fixed version
8.1-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-websocketsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider disabling HTTP Basic Authentication in your application to mitigate the risk of timing attacks until the package can be updated.
Conclusion
The timing attack vulnerability in the Python Websockets package poses a significant risk to applications utilizing HTTP Basic Authentication. It is crucial to update to the latest patched version to safeguard against potential attacks. Users should also consider temporary workarounds if immediate updates are not possible.
See every vulnerability recorded for python-websockets →
FAQ
The vulnerability is a timing attack that allows an attacker to guess passwords through observable timing discrepancies when using HTTP Basic Authentication.
Versions prior to 9.1 of the Python Websockets package are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, consider disabling HTTP Basic Authentication as a temporary workaround to reduce the risk.
More information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-33880.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-websockets.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
