GHSA-r838-q6jp-58xx

Improper Restriction of Excessive Authentication Attempts in py-bcrypt

Source: GitHub Advisory Database (reviewed) High CVE-2013-1895

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	py-bcrypt	< 0.3	0.3

Details

As written in the advisory (Markdown source, shown as plain text).

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-1895 advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/83039 web
https://github.com/advisories/GHSA-r838-q6jp-58xx advisory
https://github.com/grnet/python-bcrypt package
https://github.com/pypa/advisory-database/tree/main/vulns/py-bcrypt/PYSEC-2020-249.yaml web
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101382.html web
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101387.html web
http://www.openwall.com/lists/oss-security/2013/03/26/2 web