CVE-2021-33880: Observable Timing Discrepancy in aaugustin websockets library
Summary
CVE-2021-33880: Observable Timing Discrepancy in aaugustin websockets library. Affects websockets versions < 9.1. Fixed in 9.1. How to fix ↓
Also tracked for
- python-websockets · Debian:11
The same CVE-2021-33880 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aaugustin websockets library is a Python package available on PyPI. It provides a high-level API for implementing WebSocket servers and clients. WebSocket is a communication protocol that enables full-duplex communication between a client and a server over a single, long-lived connection. The library allows developers to build real-time applications such as chat systems, collaborative editing tools, and more. However, versions before 9.1 of the library are vulnerable to an Observable Timing Discrepancy when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). This vulnerability can potentially allow an attacker to guess a password through a timing attack.
Vulnerability Detail
The Observable Timing Discrepancy vulnerability in the aaugustin websockets library arises due to a timing discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). This vulnerability can be exploited by an attacker to guess a password by analyzing the timing of responses from the server. By carefully measuring the time it takes for the server to respond to different password guesses, an attacker can deduce the correct password. This vulnerability has a CVSS score of 5.9, indicating a moderate severity level. It is important to note that this vulnerability affects versions of the library prior to 9.1.
How To Fix
Latest published version: 17.3.0 as of 22 Oct 2026
pip install --upgrade "websockets==17.3.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.1
This is the first release that contains the fix.
pip install --upgrade "websockets==9.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The aaugustin websockets library versions prior to 9.1 are vulnerable to an Observable Timing Discrepancy when HTTP Basic Authentication is enabled. This vulnerability can potentially allow an attacker to guess a password through a timing attack. It is recommended to upgrade to version 9.1 or later of the library to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for websockets →
FAQ
The aaugustin websockets library is a Python package that provides a high-level API for implementing WebSocket servers and clients. It allows developers to build real-time applications that require bidirectional communication between a client and a server over a single, long-lived connection.
This vulnerability can potentially allow an attacker to guess a password through a timing attack. By analyzing the timing of responses from the server, an attacker can deduce the correct password.
To fix this vulnerability, it is recommended to upgrade to version 9.1 or later of the aaugustin websockets library. This version includes a fix for the Observable Timing Discrepancy. Developers can update the library by running the following command: pip install --upgrade websockets
No specific workaround has been mentioned for this vulnerability.
This vulnerability has a CVSS score of 5.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for websockets.
