CVE-2013-1895

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.

Score

CVSS 3.1 7.5 High

Status

Modified - secalert@redhat.com

Published

2020-01-28

Last modified

2024-08-06

Weaknesses

CWE-307

Affected products

• Fedora (Fedoraproject)
• Py-bcrypt (Py-bcrypt)
• Py-bcrypt (Python)

References

• http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html
• http://www.openwall.com/lists/oss-security/2013/03/26/2
• http://www.securityfocus.com/bid/58702
• https://exchange.xforce.ibmcloud.com/vulnerabilities/83039